7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fb

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe
Size

468KB
MD5

41ecf9631f1336f238679632284cd8d0
SHA1

bf75bd3bfa05582d842910f4ee2e5a1d43c59af7
SHA256

7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fb
SHA512

15c79874b924c23e42c31780151b3d88b740558c2871d16e96ec7d04b7b8eba3d35a936bdbb99bfb66773429baa3a0d1f4e2bfdbd5283fdb7e8355779f313fce
SSDEEP

3072:W1NhogLdaH8Unb/6Pz5Fff1cfhj5I8snmHexVioqeDSGMBNu5lk:W1fo9cUnGP1FffsxeLqeG3BNu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2396	Unicorn-52358.exe
3348	Unicorn-23350.exe
1660	Unicorn-52685.exe
228	Unicorn-52278.exe
4128	Unicorn-16076.exe
4092	Unicorn-35942.exe
1276	Unicorn-45572.exe
984	Unicorn-38646.exe
4608	Unicorn-38573.exe
1100	Unicorn-18911.exe
3940	Unicorn-5781.exe
936	Unicorn-34348.exe
1808	Unicorn-51453.exe
4044	Unicorn-37878.exe
956	Unicorn-12396.exe
3228	Unicorn-6565.exe
516	Unicorn-48838.exe
4836	Unicorn-24822.exe
4132	Unicorn-57494.exe
840	Unicorn-40582.exe
4540	Unicorn-64516.exe
3636	Unicorn-7644.exe
4820	Unicorn-23212.exe
4020	Unicorn-39548.exe
4892	Unicorn-53284.exe
3892	Unicorn-59414.exe
4072	Unicorn-25974.exe
4372	Unicorn-9637.exe
4360	Unicorn-36372.exe
4884	Unicorn-6300.exe
4948	Unicorn-3109.exe
3528	Unicorn-16108.exe
2892	Unicorn-38662.exe
3048	Unicorn-65396.exe
2232	Unicorn-2014.exe
468	Unicorn-18028.exe
736	Unicorn-54038.exe
404	Unicorn-24188.exe
5112	Unicorn-59622.exe
820	Unicorn-59622.exe
1348	Unicorn-59622.exe
2788	Unicorn-54724.exe
4060	Unicorn-43789.exe
3092	Unicorn-38188.exe
1172	Unicorn-30022.exe
1048	Unicorn-13685.exe
5064	Unicorn-30214.exe
440	Unicorn-24083.exe
4624	Unicorn-63078.exe
3508	Unicorn-29638.exe
1868	Unicorn-62502.exe
4736	Unicorn-46742.exe
1344	Unicorn-42828.exe
1440	Unicorn-42828.exe
1708	Unicorn-42828.exe
3820	Unicorn-56564.exe
1516	Unicorn-62429.exe
4256	Unicorn-62429.exe
2848	Unicorn-56372.exe
880	Unicorn-6965.exe
1028	Unicorn-39830.exe
3364	Unicorn-49460.exe
3248	Unicorn-52061.exe
5108	Unicorn-22534.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9372	5836	WerFault.exe	226
10212	7888	WerFault.exe	322

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19314.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18467.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4864	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16316	dwm.exe
Token: SeChangeNotifyPrivilege	16316	dwm.exe
Token: 33	16316	dwm.exe
Token: SeIncBasePriorityPrivilege	16316	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe
2396	Unicorn-52358.exe
1660	Unicorn-52685.exe
3348	Unicorn-23350.exe
4092	Unicorn-35942.exe
228	Unicorn-52278.exe
1276	Unicorn-45572.exe
4128	Unicorn-16076.exe
984	Unicorn-38646.exe
4608	Unicorn-38573.exe
1100	Unicorn-18911.exe
956	Unicorn-12396.exe
3940	Unicorn-5781.exe
1808	Unicorn-51453.exe
936	Unicorn-34348.exe
4044	Unicorn-37878.exe
3228	Unicorn-6565.exe
516	Unicorn-48838.exe
4836	Unicorn-24822.exe
4132	Unicorn-57494.exe
840	Unicorn-40582.exe
4540	Unicorn-64516.exe
3636	Unicorn-7644.exe
4884	Unicorn-6300.exe
4820	Unicorn-23212.exe
4020	Unicorn-39548.exe
4372	Unicorn-9637.exe
3892	Unicorn-59414.exe
4072	Unicorn-25974.exe
4360	Unicorn-36372.exe
4892	Unicorn-53284.exe
4948	Unicorn-3109.exe
3528	Unicorn-16108.exe
2892	Unicorn-38662.exe
3048	Unicorn-65396.exe
468	Unicorn-18028.exe
2232	Unicorn-2014.exe
736	Unicorn-54038.exe
404	Unicorn-24188.exe
5112	Unicorn-59622.exe
1348	Unicorn-59622.exe
820	Unicorn-59622.exe
2788	Unicorn-54724.exe
3092	Unicorn-38188.exe
4060	Unicorn-43789.exe
1172	Unicorn-30022.exe
5064	Unicorn-30214.exe
1048	Unicorn-13685.exe
440	Unicorn-24083.exe
1868	Unicorn-62502.exe
4624	Unicorn-63078.exe
4736	Unicorn-46742.exe
3820	Unicorn-56564.exe
1708	Unicorn-42828.exe
1516	Unicorn-62429.exe
1440	Unicorn-42828.exe
4256	Unicorn-62429.exe
1344	Unicorn-42828.exe
2848	Unicorn-56372.exe
880	Unicorn-6965.exe
1028	Unicorn-39830.exe
3248	Unicorn-52061.exe
5108	Unicorn-22534.exe
3364	Unicorn-49460.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2396	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	82
PID 2460 wrote to memory of 2396	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	82
PID 2460 wrote to memory of 2396	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	82
PID 2396 wrote to memory of 3348	2396	Unicorn-52358.exe	83
PID 2396 wrote to memory of 3348	2396	Unicorn-52358.exe	83
PID 2396 wrote to memory of 3348	2396	Unicorn-52358.exe	83
PID 2460 wrote to memory of 1660	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	84
PID 2460 wrote to memory of 1660	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	84
PID 2460 wrote to memory of 1660	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	84
PID 3348 wrote to memory of 228	3348	Unicorn-23350.exe	89
PID 3348 wrote to memory of 228	3348	Unicorn-23350.exe	89
PID 3348 wrote to memory of 228	3348	Unicorn-23350.exe	89
PID 2396 wrote to memory of 4128	2396	Unicorn-52358.exe	90
PID 2396 wrote to memory of 4128	2396	Unicorn-52358.exe	90
PID 2396 wrote to memory of 4128	2396	Unicorn-52358.exe	90
PID 1660 wrote to memory of 4092	1660	Unicorn-52685.exe	91
PID 1660 wrote to memory of 4092	1660	Unicorn-52685.exe	91
PID 1660 wrote to memory of 4092	1660	Unicorn-52685.exe	91
PID 2460 wrote to memory of 1276	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	92
PID 2460 wrote to memory of 1276	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	92
PID 2460 wrote to memory of 1276	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	92
PID 1276 wrote to memory of 984	1276	Unicorn-45572.exe	94
PID 1276 wrote to memory of 984	1276	Unicorn-45572.exe	94
PID 1276 wrote to memory of 984	1276	Unicorn-45572.exe	94
PID 2460 wrote to memory of 4608	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	95
PID 2460 wrote to memory of 4608	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	95
PID 2460 wrote to memory of 4608	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	95
PID 4092 wrote to memory of 1100	4092	Unicorn-35942.exe	96
PID 4092 wrote to memory of 1100	4092	Unicorn-35942.exe	96
PID 4092 wrote to memory of 1100	4092	Unicorn-35942.exe	96
PID 228 wrote to memory of 3940	228	Unicorn-52278.exe	97
PID 228 wrote to memory of 3940	228	Unicorn-52278.exe	97
PID 228 wrote to memory of 3940	228	Unicorn-52278.exe	97
PID 3348 wrote to memory of 936	3348	Unicorn-23350.exe	98
PID 3348 wrote to memory of 936	3348	Unicorn-23350.exe	98
PID 3348 wrote to memory of 936	3348	Unicorn-23350.exe	98
PID 1660 wrote to memory of 1808	1660	Unicorn-52685.exe	99
PID 1660 wrote to memory of 1808	1660	Unicorn-52685.exe	99
PID 1660 wrote to memory of 1808	1660	Unicorn-52685.exe	99
PID 4128 wrote to memory of 4044	4128	Unicorn-16076.exe	100
PID 4128 wrote to memory of 4044	4128	Unicorn-16076.exe	100
PID 4128 wrote to memory of 4044	4128	Unicorn-16076.exe	100
PID 2396 wrote to memory of 956	2396	Unicorn-52358.exe	101
PID 2396 wrote to memory of 956	2396	Unicorn-52358.exe	101
PID 2396 wrote to memory of 956	2396	Unicorn-52358.exe	101
PID 984 wrote to memory of 3228	984	Unicorn-38646.exe	104
PID 984 wrote to memory of 3228	984	Unicorn-38646.exe	104
PID 984 wrote to memory of 3228	984	Unicorn-38646.exe	104
PID 1276 wrote to memory of 516	1276	Unicorn-45572.exe	105
PID 1276 wrote to memory of 516	1276	Unicorn-45572.exe	105
PID 1276 wrote to memory of 516	1276	Unicorn-45572.exe	105
PID 4608 wrote to memory of 4836	4608	Unicorn-38573.exe	106
PID 4608 wrote to memory of 4836	4608	Unicorn-38573.exe	106
PID 4608 wrote to memory of 4836	4608	Unicorn-38573.exe	106
PID 956 wrote to memory of 4132	956	Unicorn-12396.exe	107
PID 956 wrote to memory of 4132	956	Unicorn-12396.exe	107
PID 956 wrote to memory of 4132	956	Unicorn-12396.exe	107
PID 1100 wrote to memory of 840	1100	Unicorn-18911.exe	108
PID 1100 wrote to memory of 840	1100	Unicorn-18911.exe	108
PID 1100 wrote to memory of 840	1100	Unicorn-18911.exe	108
PID 2460 wrote to memory of 4540	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	109
PID 2460 wrote to memory of 4540	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	109
PID 2460 wrote to memory of 4540	2460	7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe	109
PID 2396 wrote to memory of 3636	2396	Unicorn-52358.exe	110

C:\Users\Admin\AppData\Local\Temp\7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe
"C:\Users\Admin\AppData\Local\Temp\7fed22f390c22591d381400192df0aa93eafacefad093777b92440749d4368fbN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        10⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
        9⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        9⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        9⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49404.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        8⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60438.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13621.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        9⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        9⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43005.exe
        8⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10491.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        8⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        8⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7320.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7900.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23061.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        7⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        9⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        10⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        10⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        9⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        9⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
        9⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12581.exe
        8⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65181.exe
        8⤵
        
        PID:13908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7435.exe
        8⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        9⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16316.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58051.exe
        8⤵
        
        PID:17460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48870.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        7⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22380.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        8⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        8⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32981.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46214.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20134.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3822.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11442.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24236.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        6⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23414.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55236.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
        5⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        6⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        6⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46742.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        9⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
        9⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
        9⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19717.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        8⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61804.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43098.exe
        6⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        9⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        8⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26076.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
        7⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        6⤵
        
        PID:18028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45524.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52390.exe
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43813.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6744.exe
        6⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33974.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55852.exe
        8⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24620.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11084.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        7⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30051.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30546.exe
        6⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        6⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60716.exe
        5⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19942.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8181.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32876.exe
        6⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
        5⤵
        
        PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        6⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        5⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56901.exe
        6⤵
        
        PID:17932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16255.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      PID:16480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49631.exe
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        9⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54780.exe
        9⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1154.exe
        9⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        8⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
        8⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18438.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        8⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17983.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42981.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53548.exe
        7⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19942.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25350.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10158.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7541.exe
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        7⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        7⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34517.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40669.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        6⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38406.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22294.exe
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        8⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27036.exe
        7⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        7⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44301.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36147.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22188.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58031.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        7⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42597.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21512.exe
        6⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        5⤵
        
        PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-158.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51446.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33858.exe
        7⤵
        
        PID:17772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24700.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46803.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23260.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        5⤵
        
        PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        5⤵
        
        PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26559.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
      4⤵
      PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62836.exe
      4⤵
      PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exe
        6⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59935.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52966.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        7⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1826.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37501.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        7⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        5⤵
        
        PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17747.exe
      4⤵
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59766.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        5⤵
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48998.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24917.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        5⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10008.exe
        5⤵
        
        PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21404.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8949.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61445.exe
      4⤵
      PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57894.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        6⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5836 -s 632
        7⤵
        Program crash
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49183.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
        6⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        6⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11253.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        5⤵
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51135.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        7⤵
        
        PID:17972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53436.exe
        6⤵
        
        PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        5⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58924.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31762.exe
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
      4⤵
      PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
      4⤵
      PID:16052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47046.exe
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        6⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        7⤵
        
        PID:18000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18540.exe
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40541.exe
      4⤵
      PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42293.exe
        5⤵
        
        PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
    3⤵
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
      4⤵
      PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16639.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        5⤵
        
        PID:16840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
      4⤵
      PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
      4⤵
      PID:16288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
    3⤵
    PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        5⤵
        
        PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
      4⤵
      PID:15416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
    3⤵
    PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58815.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
      4⤵
      PID:16192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
    3⤵
    PID:5372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37270.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        9⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        10⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39323.exe
        10⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        9⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36797.exe
        9⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        8⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6651.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55251.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        6⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27670.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        9⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        10⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        9⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        9⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18181.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9774.exe
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36949.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53059.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31430.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exe
        6⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43789.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        9⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
        10⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        9⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        9⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65462.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        8⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54125.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        8⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38955.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        7⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        8⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
        6⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        6⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        5⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44198.exe
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23468.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        6⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8453.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56438.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20636.exe
        5⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        5⤵
        Executes dropped EXE
        
        PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        5⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32662.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63926.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18629.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48432.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57948.exe
        6⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36470.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52070.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36438.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4514.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2956.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47254.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57462.exe
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31653.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        6⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26844.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        5⤵
        
        PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        5⤵
        
        PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28341.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      4⤵
      PID:12752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7157.exe
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43046.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        8⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41523.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        6⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        7⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        6⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        5⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        6⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34918.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        5⤵
        
        PID:16832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50228.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        6⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
        6⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36636.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        6⤵
        
        PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
      4⤵
      PID:16132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26886.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        7⤵
        
        PID:16604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57197.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46995.exe
        6⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42877.exe
        5⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
        5⤵
        
        PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31788.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        6⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30108.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        5⤵
        
        PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17989.exe
      4⤵
      PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
      4⤵
      PID:17176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62429.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40676.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56550.exe
      4⤵
      PID:14636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
      4⤵
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
      4⤵
      PID:15948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
    3⤵
    PID:8392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
    3⤵
    PID:13248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62699.exe
    3⤵
    PID:16644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25142.exe
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22114.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58348.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20742.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16895.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2421.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
        7⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64788.exe
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19733.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13132.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41862.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26454.exe
        8⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        8⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7221.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        7⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21317.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54204.exe
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
        7⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42301.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29931.exe
        7⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
        6⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exe
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11342.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2779.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57622.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-779.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40101.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        7⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        6⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5068.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4021.exe
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        6⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        6⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        6⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        6⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12124.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43709.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22796.exe
        5⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8571.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9723.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24452.exe
      4⤵
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
        5⤵
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27656.exe
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        7⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        6⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        6⤵
        
        PID:13404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10766.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57388.exe
        7⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        5⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59311.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2053.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
      4⤵
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20492.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17861.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32601.exe
        5⤵
        
        PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42470.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15317.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
      4⤵
      PID:12736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20651.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65396.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55398.exe
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26870.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60342.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38047.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        7⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        6⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48525.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
        5⤵
        
        PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18581.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
      4⤵
      PID:16792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
    3⤵
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10533.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20002.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        5⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9915.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40349.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65139.exe
      4⤵
      PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
    3⤵
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
      4⤵
      PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46925.exe
      4⤵
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
      4⤵
      PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4869.exe
    3⤵
    PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42869.exe
      4⤵
      PID:18024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26015.exe
    3⤵
    PID:12880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46442.exe
    3⤵
    PID:14208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27830.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17279.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
        8⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
        8⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26245.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        7⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17477.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37209.exe
        6⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16757.exe
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1250.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2740.exe
        5⤵
        
        PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
      4⤵
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46278.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54383.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23849.exe
        6⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49677.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30797.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        5⤵
        
        PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-302.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
      4⤵
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
      4⤵
      PID:17124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57510.exe
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13061.exe
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        5⤵
        
        PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46995.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40781.exe
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
      4⤵
      PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50828.exe
      4⤵
      PID:16620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
    3⤵
    PID:1884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64566.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        5⤵
        
        PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59094.exe
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13868.exe
      4⤵
      PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53517.exe
    3⤵
    PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48429.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
      4⤵
      PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
      4⤵
      PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15580.exe
    3⤵
    PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57439.exe
    3⤵
    PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
    3⤵
    PID:15560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64516.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64516.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59622.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59007.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31212.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27282.exe
      4⤵
      PID:2592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52630.exe
      4⤵
      PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47971.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37404.exe
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61725.exe
      4⤵
      PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37484.exe
      4⤵
      PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46884.exe
    3⤵
    PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64758.exe
      4⤵
      PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44348.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23765.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7019.exe
      4⤵
      PID:9188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38230.exe
    3⤵
    PID:8888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
    3⤵
    PID:12588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
    3⤵
    PID:16848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-533.exe
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        6⤵
        
        PID:17748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7888 -s 652
        6⤵
        Program crash
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62966.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21644.exe
      4⤵
      PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42671.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20123.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
    3⤵
    PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50335.exe
        5⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59887.exe
        6⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17608.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56905.exe
        5⤵
        
        PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-117.exe
      4⤵
      PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40373.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12230.exe
      4⤵
      PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
    3⤵
    PID:8412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
    3⤵
    PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3170.exe
    3⤵
    PID:16804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42678.exe
  2⤵
  PID:3508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2910.exe
    3⤵
    PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45389.exe
      4⤵
      PID:13224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34915.exe
    3⤵
    PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
      4⤵
      PID:11352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
    3⤵
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
    3⤵
    PID:16084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8648.exe
    3⤵
    PID:12368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21163.exe
  2⤵
  PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38438.exe
    3⤵
    PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17215.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
      4⤵
      PID:15928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
    3⤵
    PID:12400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
    3⤵
    PID:15688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13517.exe
  2⤵
  PID:10076
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
  2⤵
  PID:13460
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5836 -ip 5836
1⤵
PID:8172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:4864

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7888 -ip 7888
1⤵
PID:8696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12396.exe

Filesize
468KB

MD5
57a1b42d4e32a6aeb3e5cc222161d72d

SHA1
c21b46ac1c5148a6e8778ca3b52d4c420bdf8093

SHA256
376a50983ea3bf27802d9695c558ae2afee2bc5712fd813b04965391c3afdce5

SHA512
a0847302ccebfe327aa9c5707f6b3c048f2beaf09e0686f57772e2812b1fc30909fce766acdf6492d75c5fe1b8b3afba29e99f8d9899b5bc87e32979ceb37925

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16076.exe

Filesize
468KB

MD5
91922b5d9d88094095099b9a9409de8d

SHA1
970702ad5e9a2a38f19d00a18780ddb54aee9165

SHA256
087377ecb7f0b64ac82a7020e643fed47a62b60cad8ce5b7e804956aea80db95

SHA512
623b8de98678f81ad1620f142dafd3d880f97aafdd0c0041a77d581d6271c64c7116d41f7ae2ba0b898689f1533d292813095f246fa2223ed08ed898150b6d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe

Filesize
468KB

MD5
05f3689212ecb9e8a1bbc16eb1f689d5

SHA1
a9ef525aecc1b02b3b1acfd31bb559d1894932bf

SHA256
de3419e32c50387b6a62e822ad74b9eedc72679642d27b8237008273e8f251b1

SHA512
53f9b1518f95bff5998bd0ef4c75875c33a6a65b17512dab3d1b0b4b03e7030f662c95db4c2f16e29ebed9dc5cc9d93188b2ef2b2e79762ddfc87f35417ae1c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe

Filesize
468KB

MD5
79ea10d0c78f3637649fdf1f3c7dc7d6

SHA1
2746d63e7e97ffa4b8057c5162933aa9e7a25249

SHA256
c59a0ac9da8aeb28ff0949c17a381711078ec89b582801dfccf35ee0cd0bd7e9

SHA512
0d49428f3c9cea33297726adec0760bb1f9303e06e8283d09b2efde0b4f6b45ca2b5f7c9151397cd3d4d4941f0314ac4841131b692fdd37075c7ffa464e8b856

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe

Filesize
468KB

MD5
205d1a6fd38c75ac64cd49c19c014758

SHA1
528621f40ce0660bd23361a82202f775c9f1ce62

SHA256
f0c4318897981a64bcd47a4983f13dfac6477656e18144b40a704439c72b5a6c

SHA512
182e188f32f012fdde3bcef4b8ca4575499a01229b3e474fe76b54be89a3b5b2987f3b5e1f4776f9481b9838b9c56a9808094a3e675fab51d62a3967ec0e25c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe

Filesize
468KB

MD5
f30c227c8e43f909e281e9861b4c2eaf

SHA1
f1503efe5f4869a57f0b104578dacf05f4123891

SHA256
eedcc8874f6eff291bc94f94adda84c6e749aeb534182c6f176abedc9772aa93

SHA512
424ac9d817cc7b18665f794a587426ae8ec6b47e8c920345b7f54a18918102de8266c2194af0e45a10160780646ee62c0ab0f9bcede43c4e2b8787ad21f8f6e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe

Filesize
468KB

MD5
2213d7627e6f2b1f4f0c3d8fb69ed8a3

SHA1
a862646a86eb854326c0c337f4f28c2df056f16c

SHA256
a65a518cb8610606d001723a1672c8bbd9e3bcd19a03946e9700029d5ec7459a

SHA512
d288332d57bc5415a8c761ab99d1320d0725963522b118303fe7533fda9521e57f0f9fece688456c4cdfc32fde12fccd4b35a976af299460b9d3237fd84737e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe

Filesize
468KB

MD5
dd782342237f0df8331a1accbf483f03

SHA1
b43facfd86973e04d2180fe4370d7cab57923811

SHA256
1ed08e6f7542859e3f3bc1f6539be48d507a4701c9c8695db64babf2e1147a1f

SHA512
151363491a15ceddfa4a095da444a1447971425b2a15e960ce2526434edfa36b12963a67c541dea13e3627ee4c10e46bd9c1adc7f343fb7db3779134bd443a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe

Filesize
468KB

MD5
38d4879ed2741890fe945aed258ef162

SHA1
9084474c11f59cdb0cfbb9a31aa94503c998e6fe

SHA256
d6dd98733997ad16e070845a4ad51c7d43fe89ec38e897ddfcd8a116dab6bbef

SHA512
adf0ed12994f5d41b75eeb0c0591a0edf87f2559caa220e55655f9db7818d849b8f96f18d1f6cc2fb3d13ed5095767b087362167fd52fc442204aaa240475c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34348.exe

Filesize
468KB

MD5
f533a601b3637215cc37a2f2d9176a98

SHA1
d904fdaada36d7064eb3a6daea6259419d630c67

SHA256
4a10b6bcd5c030d9d2e4cecd958122ee80989bdcea6ddbc06bef48ea37704f28

SHA512
27156affe650978ded627ea718a2f0f99823596435690daef7e849075edbc4dc4435cd8523c395a210dd0ed161b6d4ec96b018a6efac5ba92ad9d9a60a2ac3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe

Filesize
468KB

MD5
3135217ba4e738d5cca11a3f439c30f2

SHA1
2a36525cdc482877c99870339ba02da3625d97ba

SHA256
cbc20f6590c045ead334b24d8e66133e328c7a3df4039426be7fcfb0ce526001

SHA512
f24a85fa9940a42d877e94d24a7dd81a1fbeb4ca0e76a2bc46d4b2049bdfe144718b3e14e16331aaa3d00dd54964da86cfb430d96c9e2aec7b264a4989c54235

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe

Filesize
468KB

MD5
b5b71d5a5123a024e331d023a8f704d9

SHA1
5f41de4ff2e6ce4c02ffa329cc24013cb69516a8

SHA256
ec55e4ba68bfccd04064f3b8be3ac6c15812f3b2fa2be18d0c34dcf33ed3a298

SHA512
d5f7225d0e63a0071f66b4b34fbfbd0b4c19488c85d7f7f96d2a242bd77f99649d3031ee9a2ea17b819e1b331b8193382952fac9dc7184de3c3ef406623c693f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe

Filesize
468KB

MD5
5a3a2221dc6f90c482d7cf73ffa5c1fb

SHA1
976bcb9f4d130e9e0db5506c0c137859ec4ac77f

SHA256
b6024bb95ff6734cf36b4724f626469e689f763c817e88d1fe8251c1bfabf79d

SHA512
6c8638cc3f608d407b0c96e06a5e59e0bea2de6c988c548aeeaf0c2b8c4037f4bc2043e158e8d018ee637d37d48015d0f0187a958e9ead64a95a421822b65a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe

Filesize
468KB

MD5
697b06f2c76d6e2eabbd9bfae7886c27

SHA1
568851ba0e991affad683a47ab01449ebd75b43c

SHA256
48b90cdec7016261ec5c616c81a63c85159b9df9efa9279556a7ed9c2372a3d5

SHA512
acb8a3f4e1c98068f7e482370ea0bdeeb532c576ec48db88ea0b30f4b3103040657c1b5712ebeca628202c583d1bdfa0b6d1e9b148c0e12459bf2276cba2e2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe

Filesize
468KB

MD5
39ae2926dfa098bdc549895e4ebe1af8

SHA1
7f554096baacee2b60f0b07ccb637fea655e74a3

SHA256
875819d84db56bfc749c9013ca19accd8b9dd041d3f9da803851e0e953095c1f

SHA512
fa519403fdd2ecaadfd530024f8292cd6309805540e9a278ea3dd249f0792c07c09f23d4fbe32a9adc61ee56d3f6df2b6e9550a75385111059fd13e17f4f6486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe

Filesize
468KB

MD5
e5fd77a2f7d17c11f50cb727430c1f4c

SHA1
18d00dd30a5bfe897a1b8d2d4a69e1b4f32d3a09

SHA256
5739be99a3198fa8a6d0b587d798920858e6d46db0abfa51593b0f8a1b47e593

SHA512
c850cb90d2924a2052596597bf1b4141340eb440660119b230f5791585ca3acb3579d4cb95beb263ea8348a24f78927829fb24a4ec79f6ceeea984c9cce55bdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40582.exe

Filesize
468KB

MD5
fe834267e332c0baf893361f21ee4974

SHA1
cb4c07616564d5e00f8880c131bad68c6ccafcfa

SHA256
50e2ffe4f8e9c0184e708aaa296518276b4c93724131027d93da418bda7be86a

SHA512
a481325ee0736fb763a9655ac1657c2922678942635bf3ebfc53938ba487c70478a43e15f9f4b80d00523989fbfc05ae6ec8ec8a687cb471506fd069ab6e90bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe

Filesize
468KB

MD5
cb8d802e3bd44f3cba01d0e8f29a3f78

SHA1
b0c1d8d90d40919593494a0cf074205552ae3e7f

SHA256
e8b2040f4e594681f117de72f2cc7dfd13ebb89e892008a85425282edcd00d69

SHA512
522c03e8772d7e0e7573b0d7e3e0f32e776a6c5604519053d536d412186df54863244b94463235163cd3104741b67e86dd790542bcaed8c10c29c15411f73dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe

Filesize
468KB

MD5
f6219966142b2953aaeb5beaddfd2825

SHA1
78bf7347a70cbda7ac6179d1a12ded4a05da38b4

SHA256
cb5f664dedadee447af209a8572c692e83fc4e25199d494d41f0868e760d3580

SHA512
02285a1400f4065af8d50b0fc2b4728ab1f50b9329cb2a1f4e23afc4489fd7e3bccc89ca08c2e8657306e266025f14dab442094a56463de1e71b3784ffaa83a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51453.exe

Filesize
468KB

MD5
0342df380dbbf915b9aed757402338e2

SHA1
16585430d221fc6a17368016d0adfea4084a7c36

SHA256
ebc709e42b5b67e070c2def9e5d24883bf61660ef29f99cfe72c288b654927fc

SHA512
c021862cda425fd4f6784492ae6b453106133cdbfc1de7f59f4002b1b60c5da4bd4193821f157acd5f3202bf22694a6073bd4a25f0e450e4c5a6c149e2c51c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52278.exe

Filesize
468KB

MD5
8a069bdab85d4e657340821dc8c52ff3

SHA1
34bf18d31fed61717941e2be4acf10bbbfc35560

SHA256
cd5168fb1b4f92fb4a321e6716811e88edd454620cd1b3004176167c8773ac2f

SHA512
1d74fe3a049d6a8f5f2e7e9e01c1ea40d2b209108ad92d49d0f87354a31f11a00680c455e159515ba6589d1bb8f1cfadca50c7131c490a0e08038816b5973ab9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe

Filesize
468KB

MD5
1abc663e0a0b42d408eb2a23aa6f3336

SHA1
7a6b61ca0cb95bf723c59ce77842044071ac829f

SHA256
a4f0b2065a0b4a3b5531896737a458017c096db4ceb9061001cd31c5419afc3e

SHA512
812c4b9feba2675ff12bd3dcb9b98e7fcc7c2bb013f8e3855858a7663756398ac019cc782686bce310e662994e233d3b34164f7e5bacbc767d73549053580a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe

Filesize
468KB

MD5
b36db4dc7df7a758549f6569833d25e1

SHA1
1b9541e4a4e1346fc19a8a46d801b71ba76b091b

SHA256
815fc383bf561178aecfe60e18b67f41cce686299acbec59611690a30ab84844

SHA512
3a512ea7ac282034adab377e75d7ee0960e31fbc98341d46b564b9057704a7933a8c88c3552dbfb07b7b6b4c6a4fa29d4d13035ce52ce32030d455f94da31556

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe

Filesize
468KB

MD5
44e72990fc275ed8e36ddc5df5733e13

SHA1
2e7b055a2a83f42f68edad2d9c6ebdc5e04a82de

SHA256
40ce5fe83e8cf6fdb566514f3b1d087d73f14f40b3b8782da8e35b49019be09f

SHA512
0f787fd926eca490618d5b376d2ee94b2a0ec4e4b6cd38fca9b9d95d7564348442b902216608e198cb9c9534dbfaf3a9e594bb7e4cf42e7fc33e70e8ed955543

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe

Filesize
468KB

MD5
f94bd31bee703e3aead37258f3abef4e

SHA1
6b77868dbb3504610982211ade1b96cd88111144

SHA256
306b34a75329a8318ae8440b675f73e6dcaacc00c9faf754382869f043a8c6a9

SHA512
2913c4bb04ffaaf005defe32a5da0f3ca7ffa5430999d390439cd33b408209d2941193293a7e02d82380975267c98f44aed3a84ca3a96cb93a7e5b33d740dd05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe

Filesize
468KB

MD5
a1366288704c2e4485e53cc42bf76f12

SHA1
96889901dd7f32a1d8a2d29397c4f1d3f0459c14

SHA256
bc75ed232d5ef42e160faa9d0cbb181cc69aeed9a294655cf59e020d3dcde8ee

SHA512
4047ec23c6c36c6990fb6d26323d370a29078ced7d9eabfc599d7cb35993328b2d48d8334829a9e49b1d15f61c693c32f5694fb0d7a7efe9d8c3ce3615cd377a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59414.exe

Filesize
468KB

MD5
ce34178b2fed88e10c51feaa62ac664d

SHA1
c94a1000f90c5f763d7dcc94a7e637dfea598ac2

SHA256
e7c07108db1310a5693c8a6ade646fa6b38a682b7019659b50b3a50b80a2c153

SHA512
8e073a81fe795af54907201bd214f4256baf10218802f08f00f3fa715b0d161d929320ba2719a86eab8800e80feadbffa6ccb6404699ebcfdf0cd7214b18bf71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6300.exe

Filesize
468KB

MD5
6ab96d5590677ce9f59fc99743cbdf91

SHA1
e8baa0e089d1c93c09eb37051b4c01b9dd55353f

SHA256
4246c85aa06ea7c4959c7b6ce38ffe41775d2025dff53241e7ac67a697b96167

SHA512
ef6c34ac874745f218ef25e9a29cb9eb4650ded8e412817049e1ee526db72583d89eafbd35a08ae5b3e3dbbd20b109d0fdaae59cc267f5422be21d6afac4b6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64516.exe

Filesize
468KB

MD5
6452ec496ba9635c366e441a9c89b06e

SHA1
7f26f76e9fe56b63fecb715249442271d0e7884a

SHA256
e3157054ab2b6f94927c938028e9960f7a1fdf4555a1932f7f8856af5afa2d29

SHA512
f710f124b10348ec93c1ac4be74e3bc7904988b55dd2ac44f1066bdcb17b28310d9f8cd638988b964b58d637c28168e8ffc4a5c6cc46aafcefe52750147e7919

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe

Filesize
468KB

MD5
bb6641244c720289373fbe1f38469e76

SHA1
7fee104ec28d1d500ff572b56d618cd3119229ed

SHA256
4fcb8e589051d9d7fefa16269450b33d91b99cd7ccf1e288e0c3ada2bd21b5dd

SHA512
68da6623e83ffc30b4d5f2176f64ad7efc868feb392de5f6a06801a9cb2e75d5d93e7bcf924c158cc7dcf93dea9b377b2d99bb71adb37668e603fa74989f2b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe

Filesize
468KB

MD5
cf385cd1bf966fa3f30d771ec9e264dc

SHA1
8f5539aca729263dcfb368abf700a3c24779daca

SHA256
b52e500dd83183e5f28d45f20f86d795a89fdf4a0031f7af32c2aa6043bcb1dc

SHA512
750892526c291672bfabd6b3b02070cc79f17a342e044f597c35c3a576389408ee9b992bff206a4f2236cfa2af7f635265742b10562173e5357dfa676e9a0b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9637.exe

Filesize
468KB

MD5
b39819baa86bc6bc4189d95df8381514

SHA1
08557d14c81fd6e0c1666600539f59e8a76f05ac

SHA256
4e12614b027d61fd108e2215783443fd6b1f582cdbad66ad96555880114063aa

SHA512
9ed12fe9962bd1adebff64d2516792f0cfca37c47a39aef400def1c4b173bff0d6171ff07a1099577ddce3eb348b36fefb6ebf4347a50f883e7cf218912e166c

Download Submit
memory/228-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1028-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1100-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1884-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3348-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3820-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-581-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15244-2418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15252-2422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15344-2417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads