c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636eb

Analysis

max time kernel
120s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
Size

468KB
MD5

ca38d7f6bae401f671aef8de25b8a570
SHA1

b9ad8e21f161ac197cbb6562f0d3f2a3c0c55ffd
SHA256

c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636eb
SHA512

d294ff1417d85ac2cdb37134c73635e4dab82d221c0fdfb86bfcb6b57900363325275a97c3749910439afc7c6fec88fee11a3a42e74f047c60ee1e8a69303830
SSDEEP

3072:BqobogCdj08U2bYBPz59ff8/5CK3XXpInmHevVpLGk038188tilx:BqIoh5U2iP19ffA5SzGk6E88t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
976	Unicorn-12176.exe
4480	Unicorn-9133.exe
3876	Unicorn-55381.exe
2160	Unicorn-16846.exe
4836	Unicorn-12247.exe
3044	Unicorn-59039.exe
1736	Unicorn-65361.exe
4572	Unicorn-45201.exe
4296	Unicorn-20160.exe
4168	Unicorn-1485.exe
4620	Unicorn-50001.exe
2896	Unicorn-49809.exe
2248	Unicorn-30135.exe
1704	Unicorn-44853.exe
1336	Unicorn-49544.exe
1484	Unicorn-37550.exe
2604	Unicorn-663.exe
1792	Unicorn-57425.exe
2588	Unicorn-42734.exe
3048	Unicorn-42158.exe
2148	Unicorn-42469.exe
2868	Unicorn-36023.exe
4776	Unicorn-40430.exe
2364	Unicorn-22833.exe
3368	Unicorn-3543.exe
4912	Unicorn-31691.exe
2900	Unicorn-55889.exe
2264	Unicorn-34491.exe
3756	Unicorn-15867.exe
1028	Unicorn-2132.exe
4876	Unicorn-37265.exe
4396	Unicorn-4903.exe
2444	Unicorn-5168.exe
3904	Unicorn-41431.exe
624	Unicorn-58645.exe
4716	Unicorn-58239.exe
2960	Unicorn-16822.exe
3836	Unicorn-8295.exe
1236	Unicorn-35222.exe
2532	Unicorn-42120.exe
3424	Unicorn-15285.exe
1680	Unicorn-57003.exe
3016	Unicorn-57003.exe
4856	Unicorn-57003.exe
1196	Unicorn-20200.exe
916	Unicorn-22446.exe
4304	Unicorn-26094.exe
1988	Unicorn-26094.exe
1840	Unicorn-8497.exe
1020	Unicorn-26094.exe
3484	Unicorn-23000.exe
2780	Unicorn-28866.exe
3648	Unicorn-3665.exe
3376	Unicorn-58674.exe
2492	Unicorn-44450.exe
4344	Unicorn-29064.exe
4308	Unicorn-48555.exe
3972	Unicorn-7605.exe
1552	Unicorn-34632.exe
1964	Unicorn-49323.exe
2412	Unicorn-29457.exe
2256	Unicorn-47787.exe
3924	Unicorn-38857.exe
3936	Unicorn-12270.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6804	4700	WerFault.exe	169

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41608.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28363.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4800	dwm.exe
Token: SeChangeNotifyPrivilege	4800	dwm.exe
Token: 33	4800	dwm.exe
Token: SeIncBasePriorityPrivilege	4800	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
976	Unicorn-12176.exe
4480	Unicorn-9133.exe
3876	Unicorn-55381.exe
4836	Unicorn-12247.exe
2160	Unicorn-16846.exe
1736	Unicorn-65361.exe
3044	Unicorn-59039.exe
4572	Unicorn-45201.exe
4296	Unicorn-20160.exe
4168	Unicorn-1485.exe
4620	Unicorn-50001.exe
2248	Unicorn-30135.exe
2896	Unicorn-49809.exe
1704	Unicorn-44853.exe
1336	Unicorn-49544.exe
1484	Unicorn-37550.exe
2604	Unicorn-663.exe
1792	Unicorn-57425.exe
2588	Unicorn-42734.exe
3048	Unicorn-42158.exe
2868	Unicorn-36023.exe
2364	Unicorn-22833.exe
4776	Unicorn-40430.exe
2900	Unicorn-55889.exe
4912	Unicorn-31691.exe
2148	Unicorn-42469.exe
3368	Unicorn-3543.exe
3756	Unicorn-15867.exe
4876	Unicorn-37265.exe
1028	Unicorn-2132.exe
4396	Unicorn-4903.exe
2444	Unicorn-5168.exe
624	Unicorn-58645.exe
3904	Unicorn-41431.exe
4716	Unicorn-58239.exe
2960	Unicorn-16822.exe
3836	Unicorn-8295.exe
1236	Unicorn-35222.exe
2532	Unicorn-42120.exe
1196	Unicorn-20200.exe
3424	Unicorn-15285.exe
4856	Unicorn-57003.exe
916	Unicorn-22446.exe
3016	Unicorn-57003.exe
1680	Unicorn-57003.exe
2780	Unicorn-28866.exe
1400	Unicorn-28363.exe
2460	Unicorn-28363.exe
4304	Unicorn-26094.exe
1020	Unicorn-26094.exe
1840	Unicorn-8497.exe
3648	Unicorn-3665.exe
3484	Unicorn-23000.exe
1988	Unicorn-26094.exe
3376	Unicorn-58674.exe
2492	Unicorn-44450.exe
4344	Unicorn-29064.exe
4308	Unicorn-48555.exe
3972	Unicorn-7605.exe
4428	Unicorn-32136.exe
1552	Unicorn-34632.exe
1964	Unicorn-49323.exe
2256	Unicorn-47787.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 976	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	82
PID 232 wrote to memory of 976	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	82
PID 232 wrote to memory of 976	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	82
PID 976 wrote to memory of 4480	976	Unicorn-12176.exe	83
PID 976 wrote to memory of 4480	976	Unicorn-12176.exe	83
PID 976 wrote to memory of 4480	976	Unicorn-12176.exe	83
PID 232 wrote to memory of 3876	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	84
PID 232 wrote to memory of 3876	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	84
PID 232 wrote to memory of 3876	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	84
PID 4480 wrote to memory of 2160	4480	Unicorn-9133.exe	89
PID 4480 wrote to memory of 2160	4480	Unicorn-9133.exe	89
PID 4480 wrote to memory of 2160	4480	Unicorn-9133.exe	89
PID 976 wrote to memory of 4836	976	Unicorn-12176.exe	90
PID 976 wrote to memory of 4836	976	Unicorn-12176.exe	90
PID 976 wrote to memory of 4836	976	Unicorn-12176.exe	90
PID 232 wrote to memory of 3044	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	92
PID 232 wrote to memory of 3044	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	92
PID 232 wrote to memory of 3044	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	92
PID 3876 wrote to memory of 1736	3876	Unicorn-55381.exe	91
PID 3876 wrote to memory of 1736	3876	Unicorn-55381.exe	91
PID 3876 wrote to memory of 1736	3876	Unicorn-55381.exe	91
PID 4836 wrote to memory of 4572	4836	Unicorn-12247.exe	94
PID 4836 wrote to memory of 4572	4836	Unicorn-12247.exe	94
PID 4836 wrote to memory of 4572	4836	Unicorn-12247.exe	94
PID 976 wrote to memory of 4296	976	Unicorn-12176.exe	95
PID 976 wrote to memory of 4296	976	Unicorn-12176.exe	95
PID 976 wrote to memory of 4296	976	Unicorn-12176.exe	95
PID 1736 wrote to memory of 4168	1736	Unicorn-65361.exe	96
PID 1736 wrote to memory of 4168	1736	Unicorn-65361.exe	96
PID 1736 wrote to memory of 4168	1736	Unicorn-65361.exe	96
PID 3044 wrote to memory of 4620	3044	Unicorn-59039.exe	98
PID 3044 wrote to memory of 4620	3044	Unicorn-59039.exe	98
PID 3044 wrote to memory of 4620	3044	Unicorn-59039.exe	98
PID 2160 wrote to memory of 2896	2160	Unicorn-16846.exe	99
PID 2160 wrote to memory of 2896	2160	Unicorn-16846.exe	99
PID 2160 wrote to memory of 2896	2160	Unicorn-16846.exe	99
PID 3876 wrote to memory of 2248	3876	Unicorn-55381.exe	97
PID 3876 wrote to memory of 2248	3876	Unicorn-55381.exe	97
PID 3876 wrote to memory of 2248	3876	Unicorn-55381.exe	97
PID 4480 wrote to memory of 1704	4480	Unicorn-9133.exe	100
PID 4480 wrote to memory of 1704	4480	Unicorn-9133.exe	100
PID 4480 wrote to memory of 1704	4480	Unicorn-9133.exe	100
PID 232 wrote to memory of 1336	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	101
PID 232 wrote to memory of 1336	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	101
PID 232 wrote to memory of 1336	232	c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe	101
PID 4572 wrote to memory of 1484	4572	Unicorn-45201.exe	104
PID 4572 wrote to memory of 1484	4572	Unicorn-45201.exe	104
PID 4572 wrote to memory of 1484	4572	Unicorn-45201.exe	104
PID 4836 wrote to memory of 2604	4836	Unicorn-12247.exe	105
PID 4836 wrote to memory of 2604	4836	Unicorn-12247.exe	105
PID 4836 wrote to memory of 2604	4836	Unicorn-12247.exe	105
PID 4296 wrote to memory of 1792	4296	Unicorn-20160.exe	106
PID 4296 wrote to memory of 1792	4296	Unicorn-20160.exe	106
PID 4296 wrote to memory of 1792	4296	Unicorn-20160.exe	106
PID 4620 wrote to memory of 2588	4620	Unicorn-50001.exe	108
PID 4620 wrote to memory of 2588	4620	Unicorn-50001.exe	108
PID 4620 wrote to memory of 2588	4620	Unicorn-50001.exe	108
PID 4168 wrote to memory of 3048	4168	Unicorn-1485.exe	107
PID 4168 wrote to memory of 3048	4168	Unicorn-1485.exe	107
PID 4168 wrote to memory of 3048	4168	Unicorn-1485.exe	107
PID 976 wrote to memory of 2148	976	Unicorn-12176.exe	109
PID 976 wrote to memory of 2148	976	Unicorn-12176.exe	109
PID 976 wrote to memory of 2148	976	Unicorn-12176.exe	109
PID 3044 wrote to memory of 2868	3044	Unicorn-59039.exe	110

C:\Users\Admin\AppData\Local\Temp\c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe
"C:\Users\Admin\AppData\Local\Temp\c049ac9d9b7b6f13bcd00b7275ff2d430a85a40255c2de52565b458736d636ebN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9133.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49323.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        9⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9447.exe
        10⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        10⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        10⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        9⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        9⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        9⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        8⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2855.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12931.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7015.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        8⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17862.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        6⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48822.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        9⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35662.exe
        9⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        9⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53478.exe
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15532.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60777.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62172.exe
        7⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        8⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        8⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        7⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59542.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
        6⤵
        
        PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23000.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10823.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12818.exe
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46111.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2218.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58470.exe
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1553.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11031.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39941.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        6⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60331.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29710.exe
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        9⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
        7⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26808.exe
        6⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53896.exe
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53823.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53702.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        6⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9706.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        8⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        7⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48836.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        7⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65007.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50047.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
        5⤵
        
        PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
      4⤵
      Executes dropped EXE
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28363.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        6⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38638.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62166.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29288.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5678.exe
        7⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        6⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27953.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        5⤵
        
        PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28866.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25515.exe
        5⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60498.exe
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        5⤵
        
        PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55017.exe
      4⤵
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        5⤵
        
        PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7150.exe
      4⤵
      PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43339.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
      4⤵
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
      4⤵
      PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        10⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        10⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        10⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        9⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        9⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        9⤵
        
        PID:16832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59922.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        8⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10796.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26294.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27569.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60942.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        6⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58059.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        9⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        9⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        8⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31711.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25119.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23336.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58438.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31697.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45343.exe
        6⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46283.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60555.exe
        9⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        9⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        7⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
        6⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        7⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3416.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13168.exe
        7⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42646.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        8⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        8⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        7⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27441.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28080.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27775.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        6⤵
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36048.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
        7⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23633.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2799.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        6⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
        6⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22798.exe
        8⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21084.exe
        8⤵
        
        PID:372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        7⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22316.exe
        6⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61782.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38094.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        6⤵
        
        PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22559.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        5⤵
        
        PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24904.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        8⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54905.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
        5⤵
        
        PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62906.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51609.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        5⤵
        
        PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34568.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
        6⤵
        
        PID:788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10872.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8110.exe
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55037.exe
      4⤵
      PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
      4⤵
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        6⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52296.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45547.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        7⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13710.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5621.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32565.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        7⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52105.exe
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31822.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        5⤵
        
        PID:1816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        7⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38019.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15409.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28121.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        5⤵
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59784.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        6⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60631.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28277.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17128.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6625.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        5⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        7⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48946.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11064.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        5⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61896.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-905.exe
        5⤵
        
        PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27185.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
        6⤵
        
        PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        5⤵
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25192.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60374.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
      4⤵
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22088.exe
        5⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22990.exe
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7153.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23045.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5014.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
    3⤵
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58827.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        5⤵
        
        PID:16724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32501.exe
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
      4⤵
      PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47288.exe
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
    3⤵
    PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
    3⤵
    PID:5928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
        9⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        9⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
        9⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34222.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        8⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        9⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        9⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        8⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63993.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51282.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36520.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41503.exe
        6⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26283.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35100.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19398.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51050.exe
        7⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52679.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        6⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        6⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5262.exe
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59591.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
        6⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50386.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58404.exe
        5⤵
        
        PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65451.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30425.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8120.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33215.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19414.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14230.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46376.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9799.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        7⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50258.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        6⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57874.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6009.exe
        6⤵
        
        PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        5⤵
        
        PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45105.exe
      4⤵
      PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
        5⤵
        
        PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31209.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22893.exe
      4⤵
      PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8295.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56360.exe
        6⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35734.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13887.exe
        8⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48653.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        7⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32895.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42226.exe
        6⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64136.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3499.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21294.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37827.exe
        7⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25838.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        6⤵
        
        PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37686.exe
        5⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63112.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        5⤵
        
        PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22446.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60107.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13034.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10286.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64442.exe
        7⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3470.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        6⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1258.exe
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
      4⤵
      PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18226.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18145.exe
      4⤵
      PID:3400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7605.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13994.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53835.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        7⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61266.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        5⤵
        
        PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30953.exe
      4⤵
      PID:13512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
    3⤵
    - Executes dropped EXE
    PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25928.exe
      4⤵
      PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58600.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64630.exe
        6⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        5⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61066.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
      4⤵
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
      4⤵
      PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
      4⤵
      PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
    3⤵
    PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15798.exe
      4⤵
      PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21064.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        5⤵
        
        PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53583.exe
      4⤵
      PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        5⤵
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
      4⤵
      PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      4⤵
      PID:16624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
    3⤵
    PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
    3⤵
    PID:13308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1290.exe
    3⤵
    PID:16524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        6⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58728.exe
        9⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18766.exe
        9⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        8⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26549.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12750.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30765.exe
        7⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62344.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51615.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        5⤵
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-170.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        7⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
        6⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        7⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        6⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27979.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11551.exe
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16544.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        7⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47885.exe
        5⤵
        
        PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15352.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24011.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10028.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5742.exe
      4⤵
      PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        5⤵
        
        PID:2376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6471.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30617.exe
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        8⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        8⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        7⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10126.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60050.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-509.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51129.exe
        5⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        6⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33877.exe
        6⤵
        
        PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29872.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11372.exe
        5⤵
        
        PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13255.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45106.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3310.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20037.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16289.exe
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45553.exe
      4⤵
      PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40543.exe
      4⤵
      PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28488.exe
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35822.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13073.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1941.exe
      4⤵
      PID:16172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
    3⤵
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19743.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11874.exe
        5⤵
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39746.exe
      4⤵
      PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
      4⤵
      PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
    3⤵
    PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49842.exe
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1285.exe
      4⤵
      PID:16380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54040.exe
    3⤵
    PID:12048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
    3⤵
    PID:16972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49334.exe
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36136.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52360.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31007.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36625.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18501.exe
        6⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33944.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        6⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2520.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25321.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26510.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
        5⤵
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49558.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39344.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30581.exe
      4⤵
      PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63947.exe
      4⤵
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1890.exe
        5⤵
        
        PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8977.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        5⤵
        
        PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16929.exe
      4⤵
      PID:13448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
      4⤵
      PID:2660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40921.exe
    3⤵
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4743.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31950.exe
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30104.exe
      4⤵
      PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51750.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33311.exe
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    3⤵
    PID:11228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27982.exe
    3⤵
    PID:15332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10366.exe
    3⤵
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34152.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57423.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63577.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33769.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55279.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
        5⤵
        
        PID:16460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30936.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
      4⤵
      PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9836.exe
      4⤵
      PID:16404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40241.exe
    3⤵
    PID:4700
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 640
      4⤵
      Program crash
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    3⤵
    PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      4⤵
      PID:2424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44415.exe
    3⤵
    PID:10204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
    3⤵
    PID:13744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28085.exe
    3⤵
    PID:6508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
    3⤵
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32104.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40264.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15790.exe
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
      4⤵
      PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
      4⤵
      PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42033.exe
    3⤵
    PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
      4⤵
      PID:9492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      4⤵
      PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1752.exe
    3⤵
    PID:10392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
    3⤵
    PID:13544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
    3⤵
    PID:16788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38651.exe
  2⤵
  PID:5700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18280.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10271.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12636.exe
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11640.exe
    3⤵
    PID:13464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
  2⤵
  PID:7344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
  2⤵
  PID:10896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61246.exe
  2⤵
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4700 -ip 4700
1⤵
PID:6632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12176.exe

Filesize
468KB

MD5
b39f5e8781f173af56478a8444014433

SHA1
d1aeadd21bcb66b483729b37534d436f00084f30

SHA256
0d52eb4ac7e94d4ace1b05ae6460f8a7c1f63abed00fc71b48f0be36778909d5

SHA512
ec717e44903f268c1a27eb12ac5983150f53a4dccf58a8cb7e323936f856b3097b93e09176e7fb66c5fbf99bd2e8465d4adb25b01fc07c19de4074b71cf05ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12247.exe

Filesize
468KB

MD5
a07a8c7751627c8bb707f6fad2459ecb

SHA1
d6709e96b01e51340cf977b5a5d5779a3c101819

SHA256
afc41e89429f90568b51d2b7bb8295e7c4aa7471449fa584b8b65302464aabb6

SHA512
02f05eeb984299cadfd8037d6e784365ad17cd8e600c616d62564c3d44e8da7b2b7bbe575a140f561daf2066eeabfd05b6b5fd97b5029e2d9eee777d36030267

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe

Filesize
468KB

MD5
d2784b6610490eea0bdb2aa77b01dac8

SHA1
b0846ec2ea40805550172341c51738271bde02bc

SHA256
3e85807c12f1b10b61641b5935533e9279b678d89fbc3c3b2efda7115d1a6a6a

SHA512
b77a97121a8c759a278b97b8db828b8c4f798a73602ee0269a65f561b962c9e93141c03715ada1d588dd293cccb801409533c822c049483fa0cb3a12585fa5f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe

Filesize
468KB

MD5
1b0017a83ab7bea897d047dffaf89d04

SHA1
dafb1cb308087df0b38c9dc0ad7c9aa2b195ac8a

SHA256
91faa12e5e01203b0ed0141acbaaec68230b1b158ea92db05bdaa0685c3d290e

SHA512
f55acba15e63848cadcc45d63ea831c251bdee55d4d5024fd905d90dc868728f71d7539a19e29ef7150268ff4d199692c6aaedb54a071c6afe6a92abff3b887e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16846.exe

Filesize
468KB

MD5
b49eaf25484839edcf21af14eea78157

SHA1
17fe4d086f0487c38680f669e9de0c543c0b021b

SHA256
a01c67c2df1bf46ef257191b76158ba86f5802704a7b19b1eeba557d6a825742

SHA512
071c13ce5687ab35e24803b15a68ffa6abb0fdf8bb144c594d4a19f9288b8bb0967718efd25cb74af22e0822b04901b27e7441c3c068cd36ba4e23d551962f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe

Filesize
468KB

MD5
b7f7ad3935904d652ebfdafe68ff4549

SHA1
992cbff0515698a78c22265c80193a2c2ad53916

SHA256
79c8304333d12b3b7018e371726c64903790410987e338555be055af1e892d1c

SHA512
ba7e6c2912c7d1683513af8d3c0e3dabca8174f05bb6454d98a87a46b09a768ddb72cf477b9202a088f0150e62c9ea6575d185f3b3c75a95530fa1bef7339edd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2132.exe

Filesize
468KB

MD5
5db73c6e5aeb6ee3fdece6ca96e19047

SHA1
0c019508487d4c08eadc2eca91e849178fa7db84

SHA256
eaf07dc5005e457ee9792d5dd6bbeac88a49dd85e5ef46d8febe2a25d2da167a

SHA512
72536d266ca55b183b620c9ae24512de02a4af9b6c97fa1aa9634f98cdd49ea225936012c2d713d9eb300348f92dd05f17be313b04b0637085a8547ba82f8ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe

Filesize
468KB

MD5
56befc8599da16e2323730c2fcd4e66d

SHA1
cd809bfa648c221903bfc95e0ed5f435568513a5

SHA256
8a47e15ed0918635543519e461ed71e5360086469a5ae7116861ba900adca8a6

SHA512
cbbcf80a0942687c7fbd9687bbbb07b025fdf529871825b0244101532fa821d17c4c44d75867a23490b52d676e6ee72f5c395159fc8c9fb6c27756ea272a05fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30135.exe

Filesize
468KB

MD5
5b50c2097ab7d9125c46e9a76e907b1e

SHA1
c66fb6bb5edcf28d8065f98c7b6c1ef0f7a9ceb9

SHA256
1709f73f44552a84ba48adefc92db2f7c4f3bb7a5a553488af3b231ea6c27d3c

SHA512
1f831a95cadac8f974c44bf27e8238e70f9ef1f3db7c11b86717719fbacd654d46e8e1bf9df71f080014a66869f417ecc5d2aa558aaebecf5ce3ea6f4dc41d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe

Filesize
468KB

MD5
7985e1d61566788435b973b57f1e3972

SHA1
9abe1a8e7672cef22b629f6009d6469d67b151ae

SHA256
a73ac3c935bec0af698ef75666abd1ba18ea23147fa6a386a2b98929656aa2cb

SHA512
cf5f85eb5140c126f83240dceed3f4fc0cbd15bc4b155c4d40faa6106160912b22ba1db014ef7162857d142388b5dba0cc0bf586832e8f9df4ebe6f4fc238d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe

Filesize
468KB

MD5
998743f671362c83c48a1f6df06511bd

SHA1
50f7b571d97f76b8c08d2ebbb348420d8984cbfa

SHA256
ec82aea86b09a7ec3951e46e6167eea16f1c365c1d5dd28910ec3b2ed24a0c37

SHA512
35ce409a314c19f3a4bcdb8c6e68b0b94fe693a761c46862d12cb068eb1252d34662005c9bc284fc632b251e66168e3abe1a9d9a1b71e9cec179471384286b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe

Filesize
468KB

MD5
109a9fa41ad171817bdfdbe28a7363e0

SHA1
386086c93f1d7fbc993f384356e811bb993dc5cc

SHA256
468d1de985394ffe4eb54f4a45fcd3150e06eeba37a4c9e2ce2e073c74639153

SHA512
e6f505adbe7950a31f58914c81624ca59165c20bd0d8bc7af8899f55e323b031f50178ff424d9951f1e7227b737b09a8e3df8613fe1f0e92b4322df2a8994062

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe

Filesize
468KB

MD5
25a49c1ec203a0f26b4597c55ff45e32

SHA1
569b4ffa0ac7533bb1a87d32e1bb488009b20259

SHA256
004ae242fb8851a00c60451610af91ea209341f2734455a78080f67234b1bb87

SHA512
f33e62b0a7b9ca72c830e62bdbba37f1478faf7f5f0865ae1e413cd29af2d5e6a76ef6f038775be781393c7723adefc8abe4f6a9470f533cacc51eea91801439

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe

Filesize
468KB

MD5
4412c9c18e1c9b9bf62c8368316c7167

SHA1
3248179ac173828570b14a7151c28aab9d847cd3

SHA256
7e6e0e08ebd837c3c66ac4d48f344818cc01f9962d0f1582166ee36cdea82871

SHA512
14f50a67513873d160fc3ace88b66717ba8d87c232525daea4c9f28530a466d75ed8ec380e46f68789315886e04dca60351907553761b1499ab6940a5caa7fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe

Filesize
468KB

MD5
90b243846013488ff697b26b071e4fcf

SHA1
8bce915a7cd47de0a2f54524f81354946d247ca8

SHA256
105bc2c589702acb04565c900a519a26f364a5bfe51af44a26cd824fe2e84f99

SHA512
6431307919220705d1682ff3aacfbb493fa872f89b02f8503fe8326a5db0baf217d46dab0bef18ac38d92d7a2977aec6426246724dd11e5f021e8828cbb1cb87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe

Filesize
468KB

MD5
02de4511d3340708e6cb55b0e8679c53

SHA1
cf2aa73dbcd404e3f24ef71fb4e5f27450ebfe3c

SHA256
2a2955b03cb4d257b306e67662229bcda6ac7177feee23041e6afd2348c5fe34

SHA512
beb2b086a33620da728d0654704eca7221bf9b1025f98075f2bd4e88e2b9e14837f9b270d0cd4f7ec262fc1f84702af31adac4574fa13b56cb2430dff30b02ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42158.exe

Filesize
468KB

MD5
7f07ded711cce00900232f4736a62fdc

SHA1
d881eacc44357867c467e5c1d9935ed1abac397e

SHA256
19b5a2d6420275fa9844b385dc59e5c1c45c89764b62396f59bf823386ea79cc

SHA512
1fe6dfce6eae3e7ce997a5872187c3f51b9cb2fa7bada8b136409b4c0acc44f45101f60297a4611bf9643141aeef3f8f05b00ff4353b2194a0d4b75372ad28a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe

Filesize
468KB

MD5
a655a3f580794e16fb1776837e261f19

SHA1
57d5cc18a5353a7a720b0fa8e4c723925549c7da

SHA256
da6c8f46558bf3add43b30aad1672b51897991f1e77c646f283991a7f245ea73

SHA512
1fb1e6b1f52ee06fad4ceccf396df68f8062c9c05831734cca3bcfaf6af9bbef0ecc8d5f08bba0ae95c208683a5a1c378ea4195595305d59cdd0f7715ffbb16b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe

Filesize
468KB

MD5
f6ee44d60c841cb563c0c04cc88a2462

SHA1
70024e1e761cb50715a38aa6a322b52c898507d4

SHA256
4dd16a33c42d13af443b8543ed9428a45bd7aaa401d1ad48eafa6a8f82995e5d

SHA512
24b72e01afa2341940ffb92c94a86380280a907d7f041a36f1467d0592530ec043c8484c1c228bdd711554cd889518aa3968a43f7799eb7ad27d5b7481cb64c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe

Filesize
468KB

MD5
2a06d55da4cecf4c771e786594a48c2c

SHA1
3facf00cb952c0b8155289f95723e447cc97468e

SHA256
b9c8d0e6ac2be9c10c71eeb39f46ad1dd537842abfa614a7849fbf3867b7b578

SHA512
24d1671d5f5d55ca7a0294c021871502866ef06e197dc1666736b50807220e9512f3c6dec51b4a5c578dfc3d77c6d3045975709aba2b58d86a30b2c07466caf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe

Filesize
468KB

MD5
5c30b36163786d33cdc9169eea33b201

SHA1
8ce3261bde29d6c7c9490e622982688ef790d4d5

SHA256
b06751240078773c8995c5c1ad0d989f94c2d84a9f82c8c20674b760161bf568

SHA512
40f3b86972c14ee949951448b77d691f2f739c30a21044e7234ad204c6874f40dea7ec1e4098e59cc3d0eeecf9f1e870e40b5fed6aa652a7f9ac94999c80660b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe

Filesize
468KB

MD5
73a92df48fefa077ea07cc4fbec18f9a

SHA1
f405aef823eafa406b1023e0b63f9c4ec31f43af

SHA256
1e45ea672df772d5e302779c8e1d6baa270b542da5fe89c553525a494849968c

SHA512
d70d4c46676afd1354ce2b9451c044684d879cbbff8ad4f64e151226253964bf0a27574d41532b6dd7159a5c27de66f86db853132e166b134b5b9d21d1ebca0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe

Filesize
468KB

MD5
6346d6a07fea5213ecf7f81d355f36e2

SHA1
78030544496d10d5b98556418723db1448d6af59

SHA256
b02d2154ada30d591e0eea0a407e08be07d4a6f315cfa060f579d07270e05b90

SHA512
9092ebd74cce4838f89a5154f702fc551a2394e5d4fb2991aeb5b9f2543e7ccedf46ceb249babd07befb19a3e5a8ca831ccb28e2c7e00fa87b5d24cb6fe6bb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe

Filesize
468KB

MD5
b6033cfc649ba543ed9c686da9cdf9ac

SHA1
3f126b60713d8fca9ef64e5cca54967f51a8af25

SHA256
801e2ff55874e4675149a7ea1aa67b75d51d3af4cbf457c628f0bd599cc654a0

SHA512
535ed5fcdba894a34e9d7a630e59c9f33d91d68733321e1c626b81c1da0c6da60019bd431fa748cd8eccf29eac6d0c5b378de94b9d4b5594fad62dcca3df85af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50001.exe

Filesize
468KB

MD5
4448e62b976d873aedfb62040a85b791

SHA1
6bdc49ff47f6eacc1a4ea48ccbea194761521118

SHA256
2ef1b5d818aad4f268de97b6ad9538bfc0adb49db7a607a9c1122819c6002f9e

SHA512
f3380d055eb4b4ee211f3ffc048113115c1e555d847113d26f6cbf5ceba17e73cdf1317a4d140dbcece8f5e8e764aeb2249d90dbf83c8ad42fda5b2dea532f04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe

Filesize
468KB

MD5
61c30ba8a48bea485c5153653a327f6d

SHA1
4ce2c4e621e48a69c4a3e579090f167cb6df3c27

SHA256
c5672a0682050ebf80241744318d69abfc7ffc324f9107847313c1dc495d9ca4

SHA512
2585c69202411fece3e864b45c0d5f8b52f7be3b96ea6fa0097b0d5b0406a0f02d5e7b60657a91fad42585162a9da56312b526ea93075e700a94ef640b196e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe

Filesize
468KB

MD5
65a576756f61a4da926c05b9eb177e46

SHA1
f58228a9a2a5e87128444a89c6d20239552dbfb5

SHA256
ec4872693df72306ecb42aaab802da8974cede601a989cf702555eb827e9e611

SHA512
3f84c79d925fc4ceb666b5807156bdc01ecb83688b5d2a755a4b187361ee18d9dedf57239c58f95edddd9c0e659b20425d50d3ac39acf34c5f1712f97f275fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55889.exe

Filesize
468KB

MD5
eb643d01948cde91defd8fd067665f10

SHA1
3849f90b86aa615770c40902612d625bfb72f759

SHA256
8f918523ea95c1250741a29d66d2311a23b26b3eae90cd0e4134254e9e5d60f5

SHA512
47edc2507a53565c71fc21dc6aeb894e0bdb2a662df3c78a10c3beb57b20cc48be4091564f98be30f6fd276698f4c8eb891ddf7cc217329609315b3c28efbbd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe

Filesize
468KB

MD5
4355963338bc5b62d498aff9bd943baa

SHA1
073fb1664c4100f4910ccee8601b4b51df775f1f

SHA256
2da907e3fb96f8f5da0ea960b57f3ac4f589401f49d17ff0ccab8fe28c00f79a

SHA512
a1e2ddd7a6cf49d35c3fb43f01f5c1beb9c427da7712088ac8706440fa306495e7725b0370c88348a286313711f447a33d101a918bd4c2d74045d4248c526fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59039.exe

Filesize
468KB

MD5
288043c451913e4d83ecfd5474fe850c

SHA1
fa2c14154a676f1ac248aabcb2f4f29074a24a96

SHA256
b0feb681e88aa11538b2a4c2c8836c68883a768ec636bc0fe7238de236975e0a

SHA512
0f99d4a6a99675ca28133a5396f16a0e826ff44bff313e727f8ec245503d5ef7c4ab9358231bae8fa0c091c8f135315def18c9e3c3a3b664505f01ef60bd27a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe

Filesize
468KB

MD5
42f510350fb9476e37f8cc034015232e

SHA1
f65647ee4b609f092153b90bf802beed67a58c21

SHA256
cf064092dcbd3b7eff5a8114ee7bf8e50ae895c012bd4dbe57f6d783ab02fd2c

SHA512
4b529d526701342ba53ee372c52307282c125a5ce6c4514f1cd5e2c6912679d38ccadaf01ea224082989040b4b8943a4decb43375fc83fd8e3a87acee468757b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe

Filesize
468KB

MD5
f8a53aed0cc7e90c4bf0b5b6293b920b

SHA1
0c3d84d2ecac8c69dd7d69a2922fa933dbfcc84e

SHA256
920ef39094ff3dd1446c5bd67c326a9997470f05359caed8f3f07d413874f6a6

SHA512
6e1d9d982d2f5f04a3f6c70d9c7c5b13b638fc968340354ff2edfefc6cb32d2a0c6ce52a73f915bc474a3b38d1de4e333f054e749ad9a5c02b27aa227ed487b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9133.exe

Filesize
468KB

MD5
8f167e701b77e000c4dab6b7cd0cf444

SHA1
c17d6a046c78eb051047d29f0ada4b551931019d

SHA256
c26ef1d4ecf717e1b468ccba001575dd3a3ceb40645fd69e867e767ae623a8ac

SHA512
db82c0061b5a2d0c09d302e558a156f0abde9681a3d0b3dde79db4481fa1f6d17b3e3c15f5ff6a8bf74e322dec017e52017e9d287acd2b6851905aa9c7315674

Download Submit
memory/212-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/792-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2248-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2372-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2464-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads