3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe
Size

468KB
MD5

bf153de4c5dc01ebc33cded1968b95b0
SHA1

1e210fd385ba4804d3dbd76b9683be6f5673d9e2
SHA256

3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48
SHA512

bf25568e48c4b6a1b463f9ea6a37bd9cf3b4a686902b1f453c99a80f9da43560213c535d4ec8576fc17b35eeb14b1f6312a8ea8108d1ce44afa40f0905ea1de7
SSDEEP

3072:tqonoiLNjy8U6bYVaz5jYf5UChAoIpknmHePVsdqEVGXqqN+ll3:tqEoWLU6Wa1jYfB0GiqEIaqN+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
552	Unicorn-33547.exe
2864	Unicorn-28477.exe
4100	Unicorn-47506.exe
1180	Unicorn-56907.exe
2952	Unicorn-47348.exe
3404	Unicorn-32403.exe
1748	Unicorn-3714.exe
2404	Unicorn-35501.exe
856	Unicorn-19719.exe
3956	Unicorn-33363.exe
3132	Unicorn-17581.exe
4988	Unicorn-37447.exe
2192	Unicorn-37447.exe
4584	Unicorn-35401.exe
2524	Unicorn-41266.exe
4816	Unicorn-56881.exe
556	Unicorn-56881.exe
432	Unicorn-26246.exe
1452	Unicorn-37591.exe
1264	Unicorn-26731.exe
1932	Unicorn-17171.exe
3068	Unicorn-60779.exe
2020	Unicorn-4172.exe
748	Unicorn-4172.exe
540	Unicorn-4172.exe
1760	Unicorn-15033.exe
4188	Unicorn-15033.exe
1536	Unicorn-38983.exe
4700	Unicorn-48832.exe
1692	Unicorn-14286.exe
3116	Unicorn-12240.exe
4916	Unicorn-44411.exe
4004	Unicorn-19715.exe
684	Unicorn-65386.exe
2316	Unicorn-57218.exe
2548	Unicorn-11281.exe
3832	Unicorn-11546.exe
1620	Unicorn-11354.exe
4516	Unicorn-11354.exe
4972	Unicorn-22136.exe
3668	Unicorn-15914.exe
4132	Unicorn-24737.exe
3800	Unicorn-46549.exe
3880	Unicorn-22621.exe
3536	Unicorn-47217.exe
368	Unicorn-57431.exe
1740	Unicorn-32927.exe
3564	Unicorn-56040.exe
1512	Unicorn-10103.exe
2240	Unicorn-45179.exe
4612	Unicorn-55293.exe
3652	Unicorn-20483.exe
3112	Unicorn-39049.exe
412	Unicorn-8785.exe
5008	Unicorn-8785.exe
1600	Unicorn-3185.exe
3308	Unicorn-53155.exe
668	Unicorn-61323.exe
2340	Unicorn-32735.exe
1556	Unicorn-51764.exe
2392	Unicorn-27888.exe
4512	Unicorn-21037.exe
2276	Unicorn-58178.exe
4064	Unicorn-15220.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9720	9024	WerFault.exe	402
15080	15060	WerFault.exe	728

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22393.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42791.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15644	dwm.exe
Token: SeChangeNotifyPrivilege	15644	dwm.exe
Token: 33	15644	dwm.exe
Token: SeIncBasePriorityPrivilege	15644	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe
552	Unicorn-33547.exe
2864	Unicorn-28477.exe
4100	Unicorn-47506.exe
1180	Unicorn-56907.exe
3404	Unicorn-32403.exe
1748	Unicorn-3714.exe
2952	Unicorn-47348.exe
2404	Unicorn-35501.exe
856	Unicorn-19719.exe
3956	Unicorn-33363.exe
2192	Unicorn-37447.exe
2524	Unicorn-41266.exe
4988	Unicorn-37447.exe
3132	Unicorn-17581.exe
4584	Unicorn-35401.exe
4816	Unicorn-56881.exe
556	Unicorn-56881.exe
432	Unicorn-26246.exe
1452	Unicorn-37591.exe
1932	Unicorn-17171.exe
1264	Unicorn-26731.exe
2020	Unicorn-4172.exe
4188	Unicorn-15033.exe
748	Unicorn-4172.exe
3068	Unicorn-60779.exe
1536	Unicorn-38983.exe
1760	Unicorn-15033.exe
3116	Unicorn-12240.exe
540	Unicorn-4172.exe
1692	Unicorn-14286.exe
4700	Unicorn-48832.exe
4004	Unicorn-19715.exe
684	Unicorn-65386.exe
4916	Unicorn-44411.exe
2316	Unicorn-57218.exe
3832	Unicorn-11546.exe
2548	Unicorn-11281.exe
4516	Unicorn-11354.exe
1620	Unicorn-11354.exe
4972	Unicorn-22136.exe
3668	Unicorn-15914.exe
4132	Unicorn-24737.exe
3880	Unicorn-22621.exe
3536	Unicorn-47217.exe
3800	Unicorn-46549.exe
3564	Unicorn-56040.exe
368	Unicorn-57431.exe
1740	Unicorn-32927.exe
2240	Unicorn-45179.exe
1512	Unicorn-10103.exe
4612	Unicorn-55293.exe
3112	Unicorn-39049.exe
3308	Unicorn-53155.exe
412	Unicorn-8785.exe
1600	Unicorn-3185.exe
5008	Unicorn-8785.exe
668	Unicorn-61323.exe
3652	Unicorn-20483.exe
1556	Unicorn-51764.exe
4512	Unicorn-21037.exe
2340	Unicorn-32735.exe
2392	Unicorn-27888.exe
2276	Unicorn-58178.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 552	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	82
PID 3676 wrote to memory of 552	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	82
PID 3676 wrote to memory of 552	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	82
PID 552 wrote to memory of 2864	552	Unicorn-33547.exe	83
PID 552 wrote to memory of 2864	552	Unicorn-33547.exe	83
PID 552 wrote to memory of 2864	552	Unicorn-33547.exe	83
PID 3676 wrote to memory of 4100	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	84
PID 3676 wrote to memory of 4100	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	84
PID 3676 wrote to memory of 4100	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	84
PID 2864 wrote to memory of 1180	2864	Unicorn-28477.exe	85
PID 2864 wrote to memory of 1180	2864	Unicorn-28477.exe	85
PID 2864 wrote to memory of 1180	2864	Unicorn-28477.exe	85
PID 552 wrote to memory of 2952	552	Unicorn-33547.exe	86
PID 552 wrote to memory of 2952	552	Unicorn-33547.exe	86
PID 552 wrote to memory of 2952	552	Unicorn-33547.exe	86
PID 4100 wrote to memory of 3404	4100	Unicorn-47506.exe	87
PID 4100 wrote to memory of 3404	4100	Unicorn-47506.exe	87
PID 4100 wrote to memory of 3404	4100	Unicorn-47506.exe	87
PID 3676 wrote to memory of 1748	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	88
PID 3676 wrote to memory of 1748	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	88
PID 3676 wrote to memory of 1748	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	88
PID 1180 wrote to memory of 2404	1180	Unicorn-56907.exe	93
PID 1180 wrote to memory of 2404	1180	Unicorn-56907.exe	93
PID 1180 wrote to memory of 2404	1180	Unicorn-56907.exe	93
PID 2864 wrote to memory of 856	2864	Unicorn-28477.exe	94
PID 2864 wrote to memory of 856	2864	Unicorn-28477.exe	94
PID 2864 wrote to memory of 856	2864	Unicorn-28477.exe	94
PID 3404 wrote to memory of 3956	3404	Unicorn-32403.exe	95
PID 3404 wrote to memory of 3956	3404	Unicorn-32403.exe	95
PID 3404 wrote to memory of 3956	3404	Unicorn-32403.exe	95
PID 4100 wrote to memory of 3132	4100	Unicorn-47506.exe	96
PID 4100 wrote to memory of 3132	4100	Unicorn-47506.exe	96
PID 4100 wrote to memory of 3132	4100	Unicorn-47506.exe	96
PID 2952 wrote to memory of 2192	2952	Unicorn-47348.exe	98
PID 1748 wrote to memory of 4988	1748	Unicorn-3714.exe	97
PID 2952 wrote to memory of 2192	2952	Unicorn-47348.exe	98
PID 2952 wrote to memory of 2192	2952	Unicorn-47348.exe	98
PID 1748 wrote to memory of 4988	1748	Unicorn-3714.exe	97
PID 1748 wrote to memory of 4988	1748	Unicorn-3714.exe	97
PID 552 wrote to memory of 4584	552	Unicorn-33547.exe	99
PID 552 wrote to memory of 4584	552	Unicorn-33547.exe	99
PID 552 wrote to memory of 4584	552	Unicorn-33547.exe	99
PID 3676 wrote to memory of 2524	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	100
PID 3676 wrote to memory of 2524	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	100
PID 3676 wrote to memory of 2524	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	100
PID 2404 wrote to memory of 4816	2404	Unicorn-35501.exe	102
PID 2404 wrote to memory of 4816	2404	Unicorn-35501.exe	102
PID 2404 wrote to memory of 4816	2404	Unicorn-35501.exe	102
PID 856 wrote to memory of 556	856	Unicorn-19719.exe	103
PID 856 wrote to memory of 556	856	Unicorn-19719.exe	103
PID 856 wrote to memory of 556	856	Unicorn-19719.exe	103
PID 2864 wrote to memory of 432	2864	Unicorn-28477.exe	104
PID 2864 wrote to memory of 432	2864	Unicorn-28477.exe	104
PID 2864 wrote to memory of 432	2864	Unicorn-28477.exe	104
PID 1180 wrote to memory of 1452	1180	Unicorn-56907.exe	105
PID 1180 wrote to memory of 1452	1180	Unicorn-56907.exe	105
PID 1180 wrote to memory of 1452	1180	Unicorn-56907.exe	105
PID 2192 wrote to memory of 1264	2192	Unicorn-37447.exe	106
PID 2192 wrote to memory of 1264	2192	Unicorn-37447.exe	106
PID 2192 wrote to memory of 1264	2192	Unicorn-37447.exe	106
PID 2952 wrote to memory of 1932	2952	Unicorn-47348.exe	107
PID 2952 wrote to memory of 1932	2952	Unicorn-47348.exe	107
PID 2952 wrote to memory of 1932	2952	Unicorn-47348.exe	107
PID 3676 wrote to memory of 3068	3676	3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe	108

C:\Users\Admin\AppData\Local\Temp\3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe
"C:\Users\Admin\AppData\Local\Temp\3dae79b1ab78de8264977e05e861d37db2cb8e26d5e96837602a1c7e9968cd48N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        8⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        9⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        10⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27660.exe
        10⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        10⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        9⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        9⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49357.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17951.exe
        9⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        9⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        9⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42225.exe
        7⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        9⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        9⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        9⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
        9⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
        9⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31573.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53798.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        7⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        7⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33441.exe
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        9⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4193.exe
        10⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        9⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        9⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64441.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        8⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30487.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39169.exe
        9⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        9⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        8⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        8⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        7⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46565.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20472.exe
        9⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        8⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50088.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1786.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        7⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30042.exe
        6⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9961.exe
        6⤵
        
        PID:16692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        7⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        9⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62226.exe
        9⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        9⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        9⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        8⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        8⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59102.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        7⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        6⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        8⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28209.exe
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        7⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37359.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        6⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56409.exe
        6⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8595.exe
        7⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38500.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        6⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        5⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8142.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64131.exe
        7⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        6⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36603.exe
        5⤵
        
        PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11546.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        9⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
        9⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        9⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21926.exe
        8⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59652.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47411.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
        7⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19718.exe
        6⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53321.exe
        7⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        6⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        6⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52927.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9621.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        8⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55733.exe
        7⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14239.exe
        7⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        7⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        6⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        7⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        7⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46439.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        6⤵
        
        PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11769.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24780.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10269.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
        5⤵
        
        PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        8⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33690.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        7⤵
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        7⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44302.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        5⤵
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43939.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23534.exe
        8⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65065.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3690.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56937.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4473.exe
        5⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60649.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37846.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17676.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1920.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34583.exe
        7⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61021.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        6⤵
        
        PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2174.exe
        5⤵
        
        PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10722.exe
      4⤵
      PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22061.exe
        6⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        7⤵
        
        PID:16032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36351.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54052.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44427.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        5⤵
        
        PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41455.exe
      4⤵
      PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36554.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
      4⤵
      PID:11268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32175.exe
        9⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        9⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
        8⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20119.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
        7⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36543.exe
        6⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50192.exe
        8⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        8⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        7⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        7⤵
        
        PID:17384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        6⤵
        
        PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48345.exe
        9⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60239.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37669.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39331.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7119.exe
        7⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        5⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33392.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24982.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        5⤵
        
        PID:9024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9024 -s 464
        6⤵
        Program crash
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55996.exe
        5⤵
        
        PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58266.exe
        7⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        6⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53539.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47129.exe
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39860.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5682.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22136.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43617.exe
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
        7⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34378.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        6⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57898.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8604.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:16624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        5⤵
        
        PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25418.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36259.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51727.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        6⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19491.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55095.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57220.exe
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48605.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        5⤵
        
        PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32523.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22251.exe
      4⤵
      PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
        5⤵
        
        PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
      4⤵
      PID:11292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45179.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58193.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        6⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35429.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        5⤵
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14779.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        6⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        6⤵
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
      4⤵
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        5⤵
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15626.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
      4⤵
      PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5036.exe
      4⤵
      PID:7368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62029.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10695.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
        6⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31386.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63634.exe
        5⤵
        
        PID:16788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
      4⤵
      PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1448.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6466.exe
        6⤵
        
        PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39911.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28693.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        5⤵
        
        PID:2536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        6⤵
        
        PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        5⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        5⤵
        
        PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
      4⤵
      PID:16360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4385.exe
      4⤵
      PID:13092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
      4⤵
      PID:16452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
    3⤵
    PID:8540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
    3⤵
    PID:12412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
    3⤵
    PID:2388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62823.exe
        7⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        9⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        10⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5828.exe
        10⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        9⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        9⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60908.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44379.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        8⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5381.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63835.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53970.exe
        8⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58372.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17083.exe
        6⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31625.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        6⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6004.exe
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        8⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54493.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42137.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        7⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26210.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        5⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        7⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        6⤵
        
        PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35942.exe
        6⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9834.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24448.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        5⤵
        
        PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52905.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        7⤵
        
        PID:15416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20757.exe
        5⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        6⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25377.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16710.exe
        7⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        6⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6222.exe
        5⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        7⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63596.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31047.exe
        6⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21654.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14613.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50706.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56372.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17169.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48703.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        7⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10056.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24059.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5983.exe
        5⤵
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23071.exe
        6⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16035.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        5⤵
        
        PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5532.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38837.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
        6⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        5⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44069.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        6⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        5⤵
        
        PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34095.exe
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39195.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        5⤵
        
        PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1236.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34171.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
      4⤵
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22621.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53721.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28977.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15380.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65210.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21921.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12050.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63861.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30285.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54698.exe
      4⤵
      PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10882.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3104.exe
    3⤵
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13700.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51422.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21509.exe
        5⤵
        
        PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7919.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8748.exe
      4⤵
      PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
      4⤵
      PID:17336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52978.exe
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14122.exe
    3⤵
    PID:11308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55293.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10498.exe
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12584.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52408.exe
        8⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18479.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58167.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        7⤵
        
        PID:17396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50087.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61292.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55466.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18709.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58630.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        6⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        5⤵
        
        PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30203.exe
        5⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        6⤵
        
        PID:16440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        5⤵
        
        PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
      4⤵
      PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31623.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
      4⤵
      PID:1716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25273.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55117.exe
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46762.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11811.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33060.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5174.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
        5⤵
        
        PID:3524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32589.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32007.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27580.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
      4⤵
      PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20229.exe
      4⤵
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        5⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        6⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15598.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        5⤵
        
        PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35313.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60597.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44531.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21245.exe
      4⤵
      PID:14192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
      4⤵
      PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44702.exe
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38746.exe
      4⤵
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48709.exe
    3⤵
    PID:8088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33429.exe
    3⤵
    PID:10352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
    3⤵
    PID:15060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15060 -s 412
      4⤵
      Program crash
      PID:15080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
    3⤵
    PID:16424
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        7⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27539.exe
        7⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36404.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22985.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43227.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        6⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48900.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36036.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        5⤵
        
        PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26019.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53481.exe
        5⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
      4⤵
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25787.exe
        5⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27618.exe
        5⤵
        
        PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44240.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
      4⤵
      PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21037.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49777.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12984.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12309.exe
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41727.exe
      4⤵
      PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
      4⤵
      PID:14000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14625.exe
      4⤵
      PID:16072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
    3⤵
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19979.exe
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43367.exe
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39627.exe
      4⤵
      PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13592.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-768.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57893.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21345.exe
        6⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17378.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35045.exe
        5⤵
        
        PID:15824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47504.exe
      4⤵
      PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22663.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26119.exe
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
      4⤵
      PID:13980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
      4⤵
      PID:17064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38682.exe
    3⤵
    PID:9564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
    3⤵
    PID:13068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39169.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18094.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
      4⤵
      PID:16328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
    3⤵
    PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12673.exe
      4⤵
      PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33714.exe
    3⤵
    PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49232.exe
    3⤵
    PID:13300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
    3⤵
    PID:15936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59057.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59057.exe
  2⤵
  PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44162.exe
    3⤵
    PID:9996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53507.exe
    3⤵
    PID:12496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
    3⤵
    PID:5156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24392.exe
  2⤵
  PID:8536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
  2⤵
  PID:12380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16610.exe
  2⤵
  PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 9024 -ip 9024
1⤵
PID:10136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 15060 -ip 15060
1⤵
PID:13164

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe

Filesize
468KB

MD5
ae415e7c641d501e68a1ad2a82d9dd4d

SHA1
9e40b17f52c5a4ccac8bb84758733853c44b9f70

SHA256
21c001b9c5e810f1a2d9a165c8250cfed4a2f149e68871a496709a9c237fccb9

SHA512
84eb7ca9d302d5d5b45d258ebff63e70e491ca687b7fb1af8e1678f886366419de758daddc5baf33fca9ea4b93d1412bddb6c61cc9f27eac39790634a72bb754

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe

Filesize
468KB

MD5
9d8a0fa5e7b714068bcc4e6551c414fd

SHA1
1e1c026ac2ff093323487df8a28dd76c0b4144c4

SHA256
5b373839abe474ca8bbe985930ad30b2ffa5f6c5d48fb2422bb8b6f986f863d8

SHA512
f1eca3786eb943d276dd6a979acd382492187de6f9918afb8e3f5bcf032fb9d18ffa22771ab60e82289c4632cf09d1e6715b7db8e06d639af8dae0333257c44a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe

Filesize
468KB

MD5
8d76a91755a58b3977c37fc854f47b76

SHA1
5a1e4f6394d911ec7ff020587be6f51cdf3e27ac

SHA256
11f72d7613293b214541a3d1db1a578204d278712def4fabe6f76b74ff4fbbdf

SHA512
565e5c3ed25b101973d590b6148208db579a8ca83ec291dc71025f962bc8163c63fe711110990a0d9add46299dbd18e70164bddfecf7d489d685ceff83af32d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17171.exe

Filesize
468KB

MD5
2a08e53f4ea51240e73292db936f5411

SHA1
8f1b5bd13dc74c24bc5f8e4d229e6e9d879a1cdd

SHA256
461488e92aca9818f32f16dcda6dab953dbeff3cee8d5c9088323539697e5bd2

SHA512
20264a441f4dc86b43847188505af28a8c60128e51ebe090528ee802d35326bc680e78e89e076bfe84354272167bd33094eb4501077347d2ff0ded398f091a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17581.exe

Filesize
468KB

MD5
36153aab365548c5de81fd19c466810a

SHA1
d0b465cfb5876d91bbae7a6c48cc002610cdb910

SHA256
a398c69c5a1764f1dc433abc0220679c475493118fa1d2e7ce69fb709c70efad

SHA512
b3333f848c06139c4df7efd1a6035ec22cc39ea1b45e7af1bfcee307567bbc7cb2325cdfbc77fc5b83fe49b2cb63ce1e89a765e9a0d686dc5b2470056c816f8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe

Filesize
468KB

MD5
a634c311ae6f1008506700b4f5fc501a

SHA1
61426b0e1ed38de66b372e280653a7849d532655

SHA256
956f7fee5c0e15c2d8aa675d27a7f54f3d0a2b53aff8e6da76c79c7c5fa2a180

SHA512
4da36980a28c4433523ce771700c3319413db7aee193377fe9985c1dc9186843bcec2e5399253d6e84e42e891a3e30942cf0443de99f1a474f9091a1e1ea58f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19719.exe

Filesize
468KB

MD5
5304a2d6a05244c01cf0f7f0bb05d15b

SHA1
f3d645294caa2326bf709566402f3f292ef6b589

SHA256
79e1540bf16b112711fb1ff0fce60a68b130c0a3bc714b4f6ecc0de7a648fe10

SHA512
4502cee262efb2cfec95d63fdcc88264ca8e2b515b72ebcfeea554a9aa8de54938f3c6590f4d8fda6215b1ce3e5f5ced205452fbeaabdc8706b0cdbe486e8ec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26246.exe

Filesize
468KB

MD5
b2414e30ab878325f051d1982247f962

SHA1
8cb8a8fa4707b0787809abf3e59f058e98a336ab

SHA256
710869848c94afc0de1d93160cbec09c77d36bc2aad61748897cc27eaf11ae1c

SHA512
9d7b347ff65ed07059ce2761d0d3502145a8c57ba678f4125f6ce651417474997a81617df71e4a0b50ea9aa6dc2a511eade7908538097e2f5d76367ad8b1c88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe

Filesize
468KB

MD5
5588e5a6526e96494d7c6980bb3c4450

SHA1
5b59efcbb20999571e46291c521fe79dfe55b0e5

SHA256
1343bfebc9dff1089d7dc42dbe131d2273cc80d7dadceb1dcd6e28ab27bade3e

SHA512
ad99618671b15243c9af48d6951a1720f3e5f2150c598ab8434f652bc2c13c10c73d3d0e52a31bd92a6a900bb4884c99553f16cc3f6ac68fa295380a2f855c31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe

Filesize
468KB

MD5
57323002c011873e57c1e4bcc0862b0c

SHA1
9528e0837611b1c4780a51694aa5298cd05c3049

SHA256
c39c2f6a5b3203a217b42877f57c64a4eef6f243300d40695593d55d42c295f2

SHA512
705786e8a5ad886abe90384997c21497aee3435c7fa17499ae8bc245e61291dc1b753d9270f855fda8a9d65236f62e4f82173ecdc8b290e814f36b7766872e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe

Filesize
468KB

MD5
dc28238ea9cf30b9a72b46204ca3deb3

SHA1
69329ef16b9978cb87130583e0abbfa7f1fd95f8

SHA256
358f37366810638049badaa1bcc43ac085535ec7a4267a130321d959f5fd3a22

SHA512
10bab610529d284ebf69c6926e3f775b8654b8dbfba096d3604f2a03769b87fa2cfee1a93a73a109bc525aa19957fca2a39f6f0ebdd160017898fbb98ef47274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe

Filesize
468KB

MD5
06e24c8773292dc186c7f10ae445342d

SHA1
7cd52411ebcd5ba955d5da4b563c180b675cc2de

SHA256
f43775d6b7f276cdc9a5e1492f18ae735e111966c7bfcbe5588e88f82960179e

SHA512
414601c7e117bab75586a0eb87d74cb6caecb0eed080852f0f93b9bb668cb9d27bb9e02a7df3516446eff231c6f804b196f10b08aef7b925d7536e5f7d1b7301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33547.exe

Filesize
468KB

MD5
aa3f55bb7d7bf07bfbc8401c0f0578d0

SHA1
92cbd111f8e568260fb065621134cb7977a1d6dc

SHA256
07ce6e7d7c6d5b5b86fd25addab129589e06c55181197783eef23d6043e55f7a

SHA512
a0aa88421b8288b0bc5173b459d7d3456593ed84e131edaea41a5afdb78487124fd023e673a3f55bccfaf62e743e00a48fd480f4da9d736151265d3594dccb7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe

Filesize
468KB

MD5
13c5b05ef2f021ff6f8eded7b252fd93

SHA1
c7a16fbfbc964fe00a3c294aa0a31f3608068163

SHA256
ea02c0e359f262cf09aa70e0c9df0a32bde141d8ece3712c5a150e97a3da518b

SHA512
7eb7439d65b16307d36b31d2aa96baf3159c6abdfa589c8d954f1d4ffa2c6bdf3b557a97ed87636a5e37fe1e0b284c21f0a57a62a44abb35a0fe678e82bb30d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35501.exe

Filesize
468KB

MD5
f9e4901b0d67f9d24b021fe914a4c60e

SHA1
f4f55a99669652237e3137a843786aedef53ed9f

SHA256
94293f6de3f24aaeaafc843eeefebc0905581acdb3e5e57c857347196334036d

SHA512
5a1beae71ff6a1db5c7afebb0a94e668cfd90bafdd9bda3c71f4356548dafbf434b018dd96a2cdc029ea04f70a136f02abc7ae89a75b8dc7a9338fda272db0f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe

Filesize
468KB

MD5
cf04fdc280b776a485eb605641eb760b

SHA1
51823436ef4f213c91d9374135ecbe1c55bda850

SHA256
70ce91ec58b4a36e025b21923ff09ae130694fbd7339ce60fbb0d63a7e7cbc42

SHA512
412995d75f7ab55ac6693d7b8522047cdc52250726d5e9b66e1aa54f80ba58ea036a6e26157e143779b32741f836467f9ccbb10f145552956f054eac28eca4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37447.exe

Filesize
468KB

MD5
5e786df641442022ecdb0fd8e4f86083

SHA1
f4fac5c6a71a9e37d57356c8b3e75b5180597a41

SHA256
fd56fcc240d197c51cf0fe827ee90b3177c5b4cdb1f6381448535cc7855786f6

SHA512
0cc68538ac1b0af94f320068368712b8663bd43627129cdadaddce0c2581780ab70f5b4bccd2ced17682df40f50f44e15a3951b4f21118743b66e6f752151a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe

Filesize
468KB

MD5
55ffd8464970cea875b2e498dffe0822

SHA1
c1d5d9466ee3b333ac25747cc8d6939273ec8855

SHA256
36d038bdbe6d75418422967c0e6bddb9a0cc09d1b86701adbbfe4526e5620397

SHA512
377b955fc7233f553bc1285c764f8afcff95df361444c718a1fe31a85e2a02bfbbe00916d4ffe3770cc2ea003108c9220b2aaced7fbbb4e85a36633224869cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38554.exe

Filesize
468KB

MD5
23aae17beccba9c125470ada2c50c2b0

SHA1
46ec68b087c1663c741f47ed86f4b9635ac03dd9

SHA256
94f172f7a5f2ef145c3cb37562bc1c0aa97973c027f339e6b2b45905e60d9f7a

SHA512
448bb9ddde314e08d6c55a022b2c1758fc46450f5d213889c84f9645bed8eaa798a716ff08540f04642cdc1b6713d8aa185bbcf518bce4084db2956c91bb67d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe

Filesize
468KB

MD5
7f6f8c18586d009afbbe0f9b40921aa5

SHA1
149b5ba4bf1c3324ef3917453030d363519fd2a6

SHA256
db23151a4d16c3a99b7efdafc11b1f43861725c9f163de0b944f628f847d363f

SHA512
ceba53e67560226ff711b44e01b36bdf982cc361c6b7346281d7cdf361b91f783ce40083cadade03e3086418f245699d4752f1e309f06f1d61c6bc9f051c599d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41266.exe

Filesize
468KB

MD5
65fe91a787aebc4df26e4765756a7b71

SHA1
3b818313f4fb102c337060b06589c99b66bfbb80

SHA256
515f3be5a10cd8e7530bb49f504abf61371bbe05463dd4c437fcc30ae6d4a0dd

SHA512
10631066558947353ace99c5b011915cd76c7519a4962330e398744649b819fa184b00a75777277a4bef7c8ab5afd8985ea8a78c67ff39bb11bdae19a9e3c0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe

Filesize
468KB

MD5
becd8a3dfb3038e3a131cc66c5ed6791

SHA1
a2863257d46deca3315a572bc14b03d2ab40c674

SHA256
3d597b36b37e297103a1ff780a9e8ff93272ee30abdf041fd46abdce28828f40

SHA512
bea0e4c7527a9b4bb4bbf9d3d812be423422e9e440866db6b393ac5118d86f26a5c945372f79e5f6d5279317989c39de268c1a0d5d6170f74049c6d615db6041

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44411.exe

Filesize
468KB

MD5
55d9ae71c4535abbf22bd7e6c6e9de3f

SHA1
23c77fbbe5419bd676894118308a044679135adc

SHA256
74e75f4b4c93c4d320eeed98a84c384fb38b7e49bd6d39dd7bff0cc2ad86f5b4

SHA512
91543232b24079f2940f5ef022a8681b94be1189e42f5fcddeae515617b64e0499499d0db559e52a035b4581c726fba2683bfe801fdbf2e65abf5bfa1fea4037

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46207.exe

Filesize
468KB

MD5
915d2ff4c41e385e8ee8fc8f538ae448

SHA1
3bb089998f6b558b402de62dceedc19f8d48ec43

SHA256
c5f72311fed6c352742e50be70d5b8060978ef6b8886dc234af7934c7186bd3a

SHA512
38e542eabb3440f6dee4a05f4d422f06a8d60432cd5f77c4f6ab82465c6c317bef4179206cc388379d1f39abe6fc1320ee16e4a8edaa3cbcdd6800f0a568a086

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47348.exe

Filesize
468KB

MD5
b32107122ad42f6320eb14644687f08d

SHA1
9f4d6a16c17d4e10ed2faf5a4739673f6085ac95

SHA256
4b67cee9cca8e3d2b485244d5fe4a47151d61543ee0de1fd1a1051b6a41e2d55

SHA512
351cb01b65ec711a4ab3ffd2edbf2ed02acbbea0dc63652cd85e2899ef5a2bd27e5d58fefd18e588dc67c7ea8ee4603078b667ded7284be78d12fa08a6734dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe

Filesize
468KB

MD5
2ac6a10da6b0f89c96967a2e8ccff61f

SHA1
769ae6513a112f60083e314fc415a589c063507b

SHA256
5c47697cb0137ba96ad9804f0c4d34109136903bcaa3181b9b5b9793cbe38ee7

SHA512
eb709a290af0456a8a538a70e6e944a98672ca9935faaeb91dc3147d5478fd0bb8e637cc4e39c0a71f927d279f02b65407ae98e2361c0f9b59fef2c4054390d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48832.exe

Filesize
468KB

MD5
d0677a5f0dbb1ee98441e6ac77182702

SHA1
725b2954984ddf42075448a074ff808c553be9ff

SHA256
3a001a860a2d2f486948a02983883a2262fc9be26232ffdb68c4d8613d6cfeab

SHA512
688cc72db38ae5d0b8d62a7611257132b84cb630c19b7fc0eafa646da8add6cfa52e62be44531e567fa0c592626cac52a565f24cccfff0697e854071011d3d83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56881.exe

Filesize
468KB

MD5
8133fbd7fa1f7df79167692f532eb37d

SHA1
8c24a512cc2200b022f389f0cccbf55c215a6ab0

SHA256
d5e02b8771a2be0f2f4125ba1707622886f1bcd45632fa2df12832414b04e207

SHA512
9d2acf3fe1e3f0f7619257d433f2209e2241ce8785dfee53c83529aa23fde2152a8e20eb8ae2dd661198b91c0f81ba2b5f6e893df8893fbdaba68ca79212beeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56907.exe

Filesize
468KB

MD5
cc4b8c2bf89f3598d65b42603b338ca2

SHA1
0fb98bc4af3a1c40ff6de49d65dfb95815cf2fb0

SHA256
2b9e2f2009ffdafb055a29807fc637a9689634ae9db79ff5c2f4f6dcc729d367

SHA512
f37f5d37bd45ac597c74dfca5698c2c533d8be7fd77188edb99f208b379d110a518e53239343fe924884160a26de07ca6eb3ccdd4a8abe8fc48f2f85adafcd53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe

Filesize
468KB

MD5
fc8bc1fce8f130bf60f9271f4b2a7b40

SHA1
4b99389c98d142fa24d2419f8999e0a0debec053

SHA256
531b00b723aa54e5c3406eea803b3a701e0db8721a8516b26944a6d356becb95

SHA512
9201466f5a42dc2c3c3f34b841d1b353bd82dde43b9f36554671fff15730c1e57a460f4a7f05335b30c574345bb9f2119ad25c7142c1d021e1ed09df042e3027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe

Filesize
468KB

MD5
ba5bb0cb1f5d009aeb8fd465c0e51328

SHA1
6bd4f289947d285cd5a9fdd3c102d3544601abbf

SHA256
08255a290b063fe8dbbb45447de7de6e0e0dc57357688664162408614b33b30e

SHA512
bdc6c160246e176c2574fd7dfab0cb363662d0a5a5db9818b8a75fae5fd1b1e36827f795fb6f9b9ca115f51edc30a0662f94b6e6f406c6c9a83e4f0880f82fa4

Download Submit
memory/60-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/316-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/668-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2760-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads