697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
Size

468KB
MD5

c0a5ee69db0e1aa5107ef4e103fd9580
SHA1

0889d723de4929fb993b1f3b2d261627c6a0b58f
SHA256

697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892
SHA512

aa1e3a7680ca026367ff6e892d098022cdc6ad08b98ee3a03842f73c0982e2523be7ebbe04c8bf16eafff288c770ff6bfe225539a02faed822b4a045bedacf83
SSDEEP

3072:pq0RogFdjY8U2bxAPz7Wff5kChgWXpXkmHevVpfn98Cd3XKa4yAlL:pqyoq1U2OPvWff/5un98C96a4y

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2184	Unicorn-56301.exe
952	Unicorn-3732.exe
4780	Unicorn-65055.exe
1980	Unicorn-29205.exe
3020	Unicorn-8270.exe
1864	Unicorn-38224.exe
1940	Unicorn-32093.exe
3856	Unicorn-11062.exe
2004	Unicorn-30928.exe
3444	Unicorn-23829.exe
1952	Unicorn-9530.exe
3468	Unicorn-31997.exe
4616	Unicorn-18078.exe
5048	Unicorn-22485.exe
3948	Unicorn-14051.exe
556	Unicorn-24784.exe
1584	Unicorn-9324.exe
1356	Unicorn-35182.exe
3792	Unicorn-31800.exe
2640	Unicorn-31800.exe
2012	Unicorn-39968.exe
2400	Unicorn-388.exe
2336	Unicorn-123.exe
628	Unicorn-56995.exe
1988	Unicorn-388.exe
3120	Unicorn-59795.exe
1432	Unicorn-46060.exe
3488	Unicorn-46060.exe
1600	Unicorn-46060.exe
840	Unicorn-388.exe
4444	Unicorn-9236.exe
2416	Unicorn-57020.exe
4072	Unicorn-2412.exe
572	Unicorn-2412.exe
3732	Unicorn-803.exe
3564	Unicorn-20669.exe
3764	Unicorn-12692.exe
3152	Unicorn-11358.exe
4264	Unicorn-28536.exe
2512	Unicorn-28536.exe
1108	Unicorn-28536.exe
4892	Unicorn-28536.exe
220	Unicorn-22405.exe
4060	Unicorn-4146.exe
3424	Unicorn-53148.exe
3992	Unicorn-12811.exe
1168	Unicorn-6946.exe
2412	Unicorn-6946.exe
4716	Unicorn-58748.exe
1780	Unicorn-58748.exe
3680	Unicorn-58748.exe
2860	Unicorn-58748.exe
4636	Unicorn-58748.exe
3704	Unicorn-39059.exe
2056	Unicorn-11452.exe
3716	Unicorn-3677.exe
1848	Unicorn-2791.exe
2624	Unicorn-606.exe
432	Unicorn-606.exe
2820	Unicorn-606.exe
5116	Unicorn-606.exe
3588	Unicorn-5012.exe
1888	Unicorn-12687.exe
1764	Unicorn-19896.exe

Program crash 13 IoCs

pid	pid_target	Process	procid_target
3336	1980	WerFault.exe	85
4136	1980	WerFault.exe	85
1500	1356	WerFault.exe	109
4876	2004	WerFault.exe	92
1140	2004	WerFault.exe	92
1000	556	WerFault.exe	107
1116	556	WerFault.exe	107
3796	4444	WerFault.exe	130
4852	4444	WerFault.exe	130
6828	2056	WerFault.exe	158
7604	2056	WerFault.exe	158
8732	5248	WerFault.exe	199
10184	5248	WerFault.exe	199

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44906.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16752	dwm.exe
Token: SeChangeNotifyPrivilege	16752	dwm.exe
Token: 33	16752	dwm.exe
Token: SeIncBasePriorityPrivilege	16752	dwm.exe
Token: SeCreateGlobalPrivilege	9056	dwm.exe
Token: SeChangeNotifyPrivilege	9056	dwm.exe
Token: 33	9056	dwm.exe
Token: SeIncBasePriorityPrivilege	9056	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
2184	Unicorn-56301.exe
952	Unicorn-3732.exe
4780	Unicorn-65055.exe
1980	Unicorn-29205.exe
3020	Unicorn-8270.exe
1864	Unicorn-38224.exe
1940	Unicorn-32093.exe
3856	Unicorn-11062.exe
2004	Unicorn-30928.exe
3444	Unicorn-23829.exe
4616	Unicorn-18078.exe
1952	Unicorn-9530.exe
3468	Unicorn-31997.exe
5048	Unicorn-22485.exe
3948	Unicorn-14051.exe
556	Unicorn-24784.exe
1584	Unicorn-9324.exe
1356	Unicorn-35182.exe
3792	Unicorn-31800.exe
2640	Unicorn-31800.exe
2400	Unicorn-388.exe
1432	Unicorn-46060.exe
1600	Unicorn-46060.exe
3488	Unicorn-46060.exe
628	Unicorn-56995.exe
2336	Unicorn-123.exe
1988	Unicorn-388.exe
840	Unicorn-388.exe
2012	Unicorn-39968.exe
3120	Unicorn-59795.exe
4444	Unicorn-9236.exe
2416	Unicorn-57020.exe
572	Unicorn-2412.exe
4072	Unicorn-2412.exe
3732	Unicorn-803.exe
3152	Unicorn-11358.exe
3564	Unicorn-20669.exe
3764	Unicorn-12692.exe
2512	Unicorn-28536.exe
4264	Unicorn-28536.exe
220	Unicorn-22405.exe
4892	Unicorn-28536.exe
3424	Unicorn-53148.exe
4060	Unicorn-4146.exe
4716	Unicorn-58748.exe
1168	Unicorn-6946.exe
2860	Unicorn-58748.exe
3992	Unicorn-12811.exe
2412	Unicorn-6946.exe
1780	Unicorn-58748.exe
3680	Unicorn-58748.exe
1108	Unicorn-28536.exe
4636	Unicorn-58748.exe
3704	Unicorn-39059.exe
2056	Unicorn-11452.exe
3716	Unicorn-3677.exe
1848	Unicorn-2791.exe
432	Unicorn-606.exe
2624	Unicorn-606.exe
2820	Unicorn-606.exe
5116	Unicorn-606.exe
3588	Unicorn-5012.exe
1888	Unicorn-12687.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2184	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	82
PID 3300 wrote to memory of 2184	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	82
PID 3300 wrote to memory of 2184	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	82
PID 2184 wrote to memory of 952	2184	Unicorn-56301.exe	83
PID 2184 wrote to memory of 952	2184	Unicorn-56301.exe	83
PID 2184 wrote to memory of 952	2184	Unicorn-56301.exe	83
PID 3300 wrote to memory of 4780	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	84
PID 3300 wrote to memory of 4780	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	84
PID 3300 wrote to memory of 4780	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	84
PID 952 wrote to memory of 1980	952	Unicorn-3732.exe	85
PID 952 wrote to memory of 1980	952	Unicorn-3732.exe	85
PID 952 wrote to memory of 1980	952	Unicorn-3732.exe	85
PID 2184 wrote to memory of 3020	2184	Unicorn-56301.exe	86
PID 2184 wrote to memory of 3020	2184	Unicorn-56301.exe	86
PID 2184 wrote to memory of 3020	2184	Unicorn-56301.exe	86
PID 4780 wrote to memory of 1864	4780	Unicorn-65055.exe	87
PID 4780 wrote to memory of 1864	4780	Unicorn-65055.exe	87
PID 4780 wrote to memory of 1864	4780	Unicorn-65055.exe	87
PID 3300 wrote to memory of 1940	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	88
PID 3300 wrote to memory of 1940	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	88
PID 3300 wrote to memory of 1940	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	88
PID 952 wrote to memory of 3856	952	Unicorn-3732.exe	91
PID 952 wrote to memory of 3856	952	Unicorn-3732.exe	91
PID 952 wrote to memory of 3856	952	Unicorn-3732.exe	91
PID 1980 wrote to memory of 2004	1980	Unicorn-29205.exe	92
PID 1980 wrote to memory of 2004	1980	Unicorn-29205.exe	92
PID 1980 wrote to memory of 2004	1980	Unicorn-29205.exe	92
PID 3020 wrote to memory of 3444	3020	Unicorn-8270.exe	93
PID 3020 wrote to memory of 3444	3020	Unicorn-8270.exe	93
PID 3020 wrote to memory of 3444	3020	Unicorn-8270.exe	93
PID 2184 wrote to memory of 1952	2184	Unicorn-56301.exe	94
PID 2184 wrote to memory of 1952	2184	Unicorn-56301.exe	94
PID 2184 wrote to memory of 1952	2184	Unicorn-56301.exe	94
PID 1864 wrote to memory of 3468	1864	Unicorn-38224.exe	95
PID 1864 wrote to memory of 3468	1864	Unicorn-38224.exe	95
PID 1864 wrote to memory of 3468	1864	Unicorn-38224.exe	95
PID 4780 wrote to memory of 4616	4780	Unicorn-65055.exe	96
PID 4780 wrote to memory of 4616	4780	Unicorn-65055.exe	96
PID 4780 wrote to memory of 4616	4780	Unicorn-65055.exe	96
PID 1940 wrote to memory of 5048	1940	Unicorn-32093.exe	97
PID 1940 wrote to memory of 5048	1940	Unicorn-32093.exe	97
PID 1940 wrote to memory of 5048	1940	Unicorn-32093.exe	97
PID 3300 wrote to memory of 3948	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	98
PID 3300 wrote to memory of 3948	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	98
PID 3300 wrote to memory of 3948	3300	697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe	98
PID 2004 wrote to memory of 556	2004	Unicorn-30928.exe	107
PID 2004 wrote to memory of 556	2004	Unicorn-30928.exe	107
PID 2004 wrote to memory of 556	2004	Unicorn-30928.exe	107
PID 3856 wrote to memory of 1584	3856	Unicorn-11062.exe	108
PID 3856 wrote to memory of 1584	3856	Unicorn-11062.exe	108
PID 3856 wrote to memory of 1584	3856	Unicorn-11062.exe	108
PID 952 wrote to memory of 1356	952	Unicorn-3732.exe	109
PID 952 wrote to memory of 1356	952	Unicorn-3732.exe	109
PID 952 wrote to memory of 1356	952	Unicorn-3732.exe	109
PID 3444 wrote to memory of 2640	3444	Unicorn-23829.exe	110
PID 3444 wrote to memory of 2640	3444	Unicorn-23829.exe	110
PID 3444 wrote to memory of 2640	3444	Unicorn-23829.exe	110
PID 3948 wrote to memory of 3792	3948	Unicorn-14051.exe	111
PID 3948 wrote to memory of 3792	3948	Unicorn-14051.exe	111
PID 3948 wrote to memory of 3792	3948	Unicorn-14051.exe	111
PID 1952 wrote to memory of 2012	1952	Unicorn-9530.exe	112
PID 1952 wrote to memory of 2012	1952	Unicorn-9530.exe	112
PID 1952 wrote to memory of 2012	1952	Unicorn-9530.exe	112
PID 5048 wrote to memory of 2400	5048	Unicorn-22485.exe	113

C:\Users\Admin\AppData\Local\Temp\697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe
"C:\Users\Admin\AppData\Local\Temp\697ff9ccca16975244f18cce1d72f5d0b44549ec7caeb703fe348aa006dd6892N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        9⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        10⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        11⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        11⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        11⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55070.exe
        11⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 636
        10⤵
        Program crash
        
        PID:8732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5248 -s 684
        10⤵
        Program crash
        
        PID:10184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 624
        9⤵
        Program crash
        
        PID:6828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 684
        9⤵
        Program crash
        
        PID:7604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 724
        8⤵
        Program crash
        
        PID:3796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 724
        8⤵
        Program crash
        
        PID:4852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 624
        7⤵
        Program crash
        
        PID:1000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 624
        7⤵
        Program crash
        
        PID:1116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 724
        6⤵
        Program crash
        
        PID:4876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 724
        6⤵
        Program crash
        
        PID:1140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 716
        5⤵
        Program crash
        
        PID:3336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 772
        5⤵
        Program crash
        
        PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1627.exe
        9⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34556.exe
        9⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        8⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16951.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28097.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37141.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        6⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53494.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        7⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21730.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2791.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4677.exe
        9⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16650.exe
        8⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59971.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5869.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57995.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19727.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3445.exe
        7⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        6⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4431.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41381.exe
        8⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15468.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42586.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
        6⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29057.exe
        7⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43179.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20694.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52309.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3999.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54143.exe
        6⤵
        
        PID:18088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        5⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13567.exe
        5⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39063.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3923.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52613.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 492
        5⤵
        Program crash
        
        PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33641.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8236.exe
        7⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7209.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52895.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24032.exe
        5⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59829.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        7⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16109.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39022.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        5⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30465.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        5⤵
        
        PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29869.exe
        5⤵
        
        PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57129.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23985.exe
      4⤵
      PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43554.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
      4⤵
      PID:16932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2999.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        9⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        9⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        9⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        8⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        8⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        7⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
        7⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35265.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37314.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        7⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62659.exe
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
        7⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        6⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5588.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe
        8⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27923.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59852.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44807.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8010.exe
        5⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        8⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41538.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6110.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        6⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50182.exe
        7⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        6⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49603.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14262.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17310.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37575.exe
        5⤵
        
        PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25212.exe
        5⤵
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5012.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        9⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47786.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56446.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61020.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46723.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26169.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8390.exe
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        7⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        7⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53530.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        6⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65104.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        7⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14070.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
        6⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8488.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        6⤵
        
        PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14622.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
        5⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62951.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6479.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        5⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58453.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43049.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
        6⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50011.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26241.exe
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25236.exe
        5⤵
        
        PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37370.exe
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8531.exe
      4⤵
      PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
      4⤵
      PID:16408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50664.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47865.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15234.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        8⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4849.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        7⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        7⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61071.exe
        6⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52904.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22205.exe
        7⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6862.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7749.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        5⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54381.exe
        6⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        5⤵
        
        PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        5⤵
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31258.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        5⤵
        
        PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38057.exe
      4⤵
      PID:10444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9634.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
      4⤵
      PID:16716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10679.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19153.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23389.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51838.exe
        5⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20510.exe
        5⤵
        
        PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        5⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        5⤵
        
        PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        5⤵
        
        PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60966.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21174.exe
      4⤵
      PID:9200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5780.exe
      4⤵
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23264.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32254.exe
        6⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43650.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37698.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19278.exe
        5⤵
        
        PID:15048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        5⤵
        
        PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      4⤵
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      4⤵
      PID:6400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
    3⤵
    PID:60
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64948.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37402.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
      4⤵
      PID:15372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25473.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9901.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
    3⤵
    PID:10068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
    3⤵
    PID:13972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-892.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        9⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        10⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        10⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        9⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43685.exe
        9⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        8⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60541.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59769.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1308.exe
        8⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
        7⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17734.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4564.exe
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61198.exe
        7⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32790.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22966.exe
        6⤵
        
        PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        8⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        8⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8974.exe
        7⤵
        
        PID:11488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21701.exe
        7⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46559.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59448.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19463.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53663.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
        7⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19167.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47362.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53044.exe
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28450.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        5⤵
        
        PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        8⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10314.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32908.exe
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27040.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        7⤵
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43491.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62571.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41607.exe
        5⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        5⤵
        
        PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59304.exe
        5⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2395.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42972.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50701.exe
        7⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        7⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18855.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5636.exe
        6⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        6⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17422.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20527.exe
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        6⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        5⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52123.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17647.exe
        5⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        5⤵
        
        PID:16968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
      4⤵
      PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
      4⤵
      PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8364.exe
      4⤵
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63149.exe
        6⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        8⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48590.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24278.exe
        7⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        7⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45362.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30979.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        6⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25323.exe
        5⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
        7⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16301.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32252.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65469.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        7⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6375.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35778.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        6⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58664.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        6⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4846.exe
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27365.exe
        6⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20364.exe
        5⤵
        
        PID:9492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
      4⤵
      PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33449.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58379.exe
        5⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        5⤵
        
        PID:17184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23448.exe
      4⤵
      PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47372.exe
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34293.exe
      4⤵
      PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        6⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2460.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54750.exe
        6⤵
        
        PID:16060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33019.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15148.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        6⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39903.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25820.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58275.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10975.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2005.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56027.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
      4⤵
      PID:11132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44580.exe
      4⤵
      PID:15908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11639.exe
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56232.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9011.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46862.exe
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57334.exe
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        5⤵
        
        PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        5⤵
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56706.exe
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16666.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
      4⤵
      PID:16584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59064.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
      4⤵
      PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
      4⤵
      PID:14000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65118.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
    3⤵
    PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      4⤵
      PID:8900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
    3⤵
    PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47846.exe
    3⤵
    PID:14468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
    3⤵
    PID:16864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4239.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        9⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        8⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15601.exe
        8⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56453.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44403.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49484.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46902.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24526.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18887.exe
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        7⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60191.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44333.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3047.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8900.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63238.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23302.exe
        7⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        6⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62223.exe
        7⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22077.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32479.exe
        6⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51343.exe
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19180.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
        7⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65382.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34497.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43317.exe
        7⤵
        
        PID:16732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9438.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65343.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61212.exe
        7⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10911.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33406.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13333.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24425.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        6⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4838.exe
        5⤵
        
        PID:18080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
      4⤵
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62480.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        7⤵
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        5⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60021.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49898.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51556.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
        5⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19503.exe
        6⤵
        
        PID:11304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20389.exe
        5⤵
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
      4⤵
      PID:12476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33055.exe
      4⤵
      PID:15548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-606.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40377.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40997.exe
        7⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45087.exe
        5⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29220.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        6⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42608.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15413.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
      4⤵
      PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24646.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65155.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45754.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
      4⤵
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15799.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34940.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28686.exe
      4⤵
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20786.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25718.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        5⤵
        
        PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53447.exe
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
      4⤵
      PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
      4⤵
      PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42373.exe
      4⤵
      PID:10028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51349.exe
      4⤵
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        5⤵
        
        PID:17368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48362.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64056.exe
      4⤵
      PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31557.exe
      4⤵
      PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30750.exe
    3⤵
    PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50460.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51102.exe
      4⤵
      PID:17076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12690.exe
    3⤵
    PID:10472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30732.exe
    3⤵
    PID:14412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
    3⤵
    PID:16048
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57887.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
        6⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3547.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4658.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64645.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25010.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14101.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57943.exe
        5⤵
        
        PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9734.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12511.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-541.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44013.exe
        6⤵
        
        PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50517.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52131.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49987.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42846.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43080.exe
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24809.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23965.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38721.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5549.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        5⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41228.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40877.exe
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32590.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
        5⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51469.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        5⤵
        
        PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38560.exe
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8961.exe
      4⤵
      PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62414.exe
      4⤵
      PID:17000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52501.exe
      4⤵
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52678.exe
        5⤵
        
        PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13022.exe
      4⤵
      PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
    3⤵
    PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
      4⤵
      PID:15460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
    3⤵
    PID:10540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
    3⤵
    PID:15756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
    3⤵
    PID:11208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20669.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19896.exe
      4⤵
      Executes dropped EXE
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59792.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49292.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35103.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41077.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44005.exe
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3172.exe
        6⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        5⤵
        
        PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23377.exe
      4⤵
      PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3702.exe
      4⤵
      PID:9224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
    3⤵
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52571.exe
        5⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35133.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        6⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        5⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17626.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37148.exe
        5⤵
        
        PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47701.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17901.exe
    3⤵
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
      4⤵
      PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24233.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39653.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        5⤵
        
        PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27122.exe
      4⤵
      PID:10476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
      4⤵
      PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
      4⤵
      PID:8352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
    3⤵
    PID:7408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15110.exe
    3⤵
    PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13454.exe
    3⤵
    PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7532.exe
    3⤵
    PID:9708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52973.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41925.exe
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59001.exe
        5⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        6⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7439.exe
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11501.exe
        5⤵
        
        PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        5⤵
        
        PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
      4⤵
      PID:15716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36225.exe
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11378.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31100.exe
      4⤵
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27966.exe
      4⤵
      PID:9096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
    3⤵
    PID:8512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
    3⤵
    PID:12748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
    3⤵
    PID:15596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44381.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
    3⤵
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41316.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
    3⤵
    PID:10004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
    3⤵
    PID:14060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31948.exe
    3⤵
    PID:16396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21885.exe
  2⤵
  PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42385.exe
    3⤵
    PID:9176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
    3⤵
    PID:13020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
    3⤵
    PID:9840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
  2⤵
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52362.exe
  2⤵
  PID:13816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
  2⤵
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1980 -ip 1980
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1980 -ip 1980
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1356 -ip 1356
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2004 -ip 2004
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 160 -p 2004 -ip 2004
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 556 -ip 556
1⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 556 -ip 556
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4444 -ip 4444
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4444 -ip 4444
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2056 -ip 2056
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2056 -ip 2056
1⤵
PID:7724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5248 -ip 5248
1⤵
PID:8252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5248 -ip 5248
1⤵
PID:8228

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16752

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:9056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11062.exe

Filesize
468KB

MD5
57432218fe3a8cc73ea854c5ac754c4a

SHA1
b498fe6e77706d33bb2c4438ec8e40e3158ea0ab

SHA256
20c6eaedf688554749ae664a11caaffaa3c2c45d0b644beeebb292d44afcd8b8

SHA512
4e3fa8a7bed282d63cd1ee7f4cd9fcc332a04745ffa6bdecd1349b14f36541f9f63642ebd067e7b29f2d6efae674004567927dfc8d91627c693931e367484367

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe

Filesize
468KB

MD5
cc3b68982f9e8e1f4ec60c8b09f6f81d

SHA1
1009977acc9368bfb90ac699d20f39ef29c3b155

SHA256
dfeff2788c2fb51ccacef8021e68915242eba2699040f5821aad7fb4b076bd7c

SHA512
8ad4ace233ca2308d0e88483832586c6c6d9e41d954ed4c97ced7e0119ac6ac4905cd2984f9731ce37a360e6b870f853f18beeea5bda1d979dcd35fdd0c01d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe

Filesize
468KB

MD5
67f4787c7ea4b68b311314019911f40f

SHA1
0d4efcb3d1c759de4895e3ca18483dbfee796476

SHA256
1f41b47f836d83912da25ed01844818be9cd9f3848944bbee6522378dce0541b

SHA512
81507b361d51dd744f30eaedbdf743179484e197ec82d9ffbe34ae53386f7eefc0588796b980c63887200293789923b0a9e5cd03f67b3fd0d43bc4393f568ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18078.exe

Filesize
468KB

MD5
61f14825a2668e3e8dde9946da70f33c

SHA1
4fd6add9dd98b7f80b1a14106a5e52a5ea478761

SHA256
f000cc732ad6adaa2ef5699cb9c940dbccce47ac7bfc3157b5823536086049af

SHA512
756815156f0a8cfccea2de904a1b44fe4dcd0a255ea5f9dfc305959aaf703fee1ec4b228343f98bf647b4f2bd5584092cd0591bc88edbde9db6bb3762cb6ccf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22485.exe

Filesize
468KB

MD5
58a05391125753bf8e217f0e8c49af7e

SHA1
27b7a9c0ff159cdabff2fff06ac184595334b03e

SHA256
5d377a330595bee52c18ff1af89e5878cad999bad645d25f2bacf00db6feec00

SHA512
7a9a560c5b0c5e442f9621039a6fc1d91b82b872ce0208eb21fabef0a1df53acd6f4649ac65fc0711c203c62898f561030b7a3d1915e80ec31ccaa4020a6351e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe

Filesize
468KB

MD5
d08a201d055dccd20113de770ca1cb09

SHA1
8b1ab78bb445b524e845ba4641cb7d47681f7597

SHA256
c12ec22f2d7a71217714f01a7877e670021eb46dbc593a0dc608d59e582950ba

SHA512
ce962d4096408b0d81cb056ae11478599daf4c1ae368fdc5e4930fe7c5bc3c3319c934d38876fb3e8d7738d32e90f566157b43effcefca2794ee9747136dc4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2412.exe

Filesize
468KB

MD5
eceb10d28eebf46790d0773283f4e255

SHA1
361778a8aa56f88b2ec47426972a5f8ff5279199

SHA256
15961fa2d300b4364fa673f543329a4e5281b5a81ed99bbaadd29a4e919b34b5

SHA512
c119016264cb4edaf622ad12ef6dfad5ea4090e14357c73862580c2ac7bdc418df0706df5e4368b3e8635abb64eed2b2775fdd07de178d40c06cc5957506f7d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe

Filesize
468KB

MD5
dbd33d4f75a8c26faf2522d06116b4ac

SHA1
488849edd05cc9a05d79d59274f5ae37bdc08cf6

SHA256
6057027bed9eeb2d32e1ea2b09b6af3a6f9bc3615eec4ac2e6a85799396b0baf

SHA512
47aaa2e612ee3285ea5f0bda392f428e05bdf07d01bd3bbbb9ff963e8207d8d4d96eb708c8e4d35e8304032d20140baaa824434ba662f8923b99c1d9bfa40b42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe

Filesize
468KB

MD5
2b13d71ee13c3262b1f48a8ae575da5b

SHA1
235735820f2d133d4bbda4a299a1dea8c5507a9e

SHA256
62a31d83358f246baced14fe8a8d081863aaab3c0d041e81d4623bf989bac83b

SHA512
9a0f962e33485bffd90cb233c95edb5cc11e5000f05233cdfd02310508f70d840506527c72bb473e012a14ed75d6b3fe25f84a2ef980544d7ee058c6f93084bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe

Filesize
468KB

MD5
e72e21baa4af3ed9a8558ae6b8b624eb

SHA1
09c3ba140b82247cc6d49c6de407264c3c5d51ca

SHA256
2ae0b2504024d03e1d6f8ea4a3cab0687b596c9be1ecf5366866b1594c20bdd1

SHA512
568b47ca76b1d8569f736126dec31646ba88140c391aa3160ecee25baa627a2dac80b1d953f4dff2dc0b67d5ea004fac472b37f293e94e562369ae4f3d59ee8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31800.exe

Filesize
468KB

MD5
9f3036e90074770ff23c346e87f11a57

SHA1
f059f0062507faad55eb09133883a64c201b6020

SHA256
78cb5aceb2be96ee16b3222a55fa943727d69351cb98158801586e919ff1397c

SHA512
28e123d0e612066686009267088feb936d965fdc2d0b7c957278de8dad35db167058345ae09d3bb2c426646ed9d306eea4b22b4e89c7d84ea8be9718f05c17af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31997.exe

Filesize
468KB

MD5
6be97f45fcada948e77e817d2c9a763b

SHA1
57debcd7edc1682f7a2e71127602bca932020043

SHA256
80d57a4421e6ca8b6f6450d58be3d0e250c09a67d2b5fecee3ce232206eb3345

SHA512
648237ccb87a153992b4ed78d8328bfe87f78d439ac6c7e39bb6c95f352d7111b1505281ad1527ab15e2b0c987cddadac4bb61d1b7e063a058ecc09210354434

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe

Filesize
468KB

MD5
7b9426544d507b39200fd63763f49b73

SHA1
3df14531361fb893b6fffa82caee9bbf0468a568

SHA256
1595ee27f2fae6cdcd9f8658cbf95f12adf7ae1a7fc987d60307376a310d8544

SHA512
56c31afb9ecd06b6fe266112dfd32b227d10f4ddbad217704b37c474c919b56f30cc875cd214649cc04be0b55e60e96b9aa37c33d0e9fe9c2f6b97a4c856ed30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe

Filesize
468KB

MD5
736d25e63cfaed466243652a96d25c04

SHA1
b3a28ef4f6fa27ec1fb7bbc3de7f26ddd511a32a

SHA256
ca635740f387bdd7281647f9afd902e3d51a0302951f4b7c211b22e8e3646408

SHA512
70220d1530b3bf2a7efb8bf4deef848559607bfda9a60f18e85b4597db422f5182a4d49a379fc55e5a0a6d9744d497cad64bb1e1029b343004d4d24ea5a6f214

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe

Filesize
468KB

MD5
0ef43dc4f1cdec5b8fe9e5733c81181d

SHA1
5628fa0f20cdd1d4f4e84b078184d5a0e3f4bc8a

SHA256
e93beb4347401c9bfb1cc646971bc739160d9c8ae303de36310c9937724c2ecf

SHA512
a0af55851d36b0c5cc2a16b58220d9964bfc3e38a0cfbfe24648b93f6a1e38acccc0fca7a4d533b1c0058852c72da8376834e384f9b455adf1e426a736721792

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38224.exe

Filesize
468KB

MD5
0222734b1f5e93387f0cd5454a3a73b9

SHA1
c9c6fc30c6b16f0eff35b0af49990f5a82b99096

SHA256
d73a95c939894fc6bfc8cfbf0d12efab197678df05fe3e5f540955137e205e9e

SHA512
13c05572409886e8406aab0911d0bc298b0fd3e41cc821a793f43493f85b904a6d5e19ed20b172c68ab9e3172bff1c22f48350e21c2f6a19c9f745b87b7059bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-388.exe

Filesize
468KB

MD5
2dead6f873d0f34cc9bfbd4990da5790

SHA1
05116e4b67f51a312b917422516e3995c38d0934

SHA256
825811450717c9a55d0dfda7ddb9d9805d3db450bc8720f03047ff83ae09cd3e

SHA512
2d3955d81b102fea94dcc40d7c96c27807389ce1de472514b2bdab9281532fec48e2f9629449f26dad71220768b0f4175bfb62b7d433af4e29012d69ffe8254c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39042.exe

Filesize
468KB

MD5
1a70af31565d98fb985fba88ae4f0689

SHA1
af385642aa06513ac9d8c2a3cf6aa640f7491380

SHA256
53675fcdb16da127724021a14373bf070d76bf8e9f63fd72ce988cfa43fef3af

SHA512
818ee4c4b095d68b82d4021374b276546dd9df53230c70f7f92dfbd3c2facfde08ac2f4b4e18e95f500d62e214570785d05e5ecb55125fb34e54d606d763ce92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39968.exe

Filesize
468KB

MD5
4e36306db3a1ffc04ce0ecc173b20ce5

SHA1
381eef4950e0585609a85f3a94241713ab37281a

SHA256
721afb6255bb834c06ccd94a51cd499c24b10cd0c684b854cb4184267db00cc5

SHA512
54ae3d141a1cca8beb2cf9a98fb3aa959b7219582fc4c3d72f952b571be6b32a745771336ad35cb2238e09eb2f444cd9c8656c780b8de3a7e5c7c64ee775f3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45467.exe

Filesize
468KB

MD5
6bd983f33667a64016a74a9e691dc889

SHA1
c507c2d7dabc8dc1c488515eedb305e59cc561f9

SHA256
2935ad5c35bbf858a0ee959842d9ac17ad6e3aa1263011e24d50bfbdcb049a92

SHA512
0d525684fa3935cce70998061eaa733c8884a4fef20fbd192aefc71fa1b6da37893846c3a8a6045f1eef02757841d2e43a39fbe613edfe9392553e0703d2f3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe

Filesize
468KB

MD5
51ef427d72415c5c675877f86185ecc6

SHA1
0156f7abaa35f7f81fb1cd62124c943573f3dd90

SHA256
7e6932ba0ace170fbbe3746162ec0b62e0bf0cd7320a736cc6d084e4287d3fb5

SHA512
fb6e298fea7b103e4c9b785c68e4d6191b75fcd99cc7a79fdb4af0ba531c3ebf0298d8e578b6cd211501a70706e57707243791df2926d618df04917c86b7524c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56301.exe

Filesize
468KB

MD5
4fecef57d3ae2d661a4e39730ed84a0c

SHA1
a64f857cfe8c2b4d21939365714be157ddf3b057

SHA256
94c28f3029c5a90e4161a16e0c247d1e74ba8179888c8963b234e66da383b1f0

SHA512
4bf33bb43578cb76d35a4e6b538db87d9e705da26f558bf0b54deb1a0ad6f07c39d9631ae3609687ac4f8038961d6bc5e44b99ef32041afe41a82d474084791f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe

Filesize
468KB

MD5
b75b73649ec564b0c6aefa3ab8e7f59b

SHA1
478cea63b2328a0c0e946d8bccc021edeb7fd623

SHA256
99effbe7614c06c2f6a64924efabafd1a1db77fd666db9b7e41bba02b4dea6d6

SHA512
f8b748276c8e696392bbdd9aa471c871a6b44f1526ed78c73a576d51e43c0cfd092461ebde293431a0a341fd23444ee243decad76448cf6069f31c537277cdab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57020.exe

Filesize
468KB

MD5
db8561c7c09f1deed34c4959ab02171a

SHA1
78a1e7bd69bb707ba33b1e14557de1ffd5c3ba91

SHA256
e3ee97c5086de68ef5b39ddcf72b318e5c1ff78ae0d0c72cca08a919f687fc51

SHA512
0217649ae5c245cd0bb51ccfdd5086afa33f765b38d259e12df416238a349e39142e7d1907ea9de080b3ce301645bf125a2229b6cbaabcaf73c381a50202f724

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe

Filesize
468KB

MD5
dac043516f7c23954c5007c2095ffd18

SHA1
ff56cedd09690471b43f9f71f57db011f09e5cbd

SHA256
38708e18c98d37c69ab980760f4f94e9c85a7efbb53468dc9fecfb582fabf72a

SHA512
334157432fe3a06cb5d7cbe077e77813cec1e1bf77007ff23e83df3ceca34548774fd724cae50d81843fd4cbb5328c705bf0506931e3e8257465987ab12ce94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65055.exe

Filesize
468KB

MD5
4c4c95e70b11c784b1e5df9e9b9312bc

SHA1
2ac1154d10a2c4e291a8c0cf2f8d409a19796a6a

SHA256
84fb2c4fa24301ae589da72e1613e8048477cea082ac866f9e6c8fbedc2f6147

SHA512
987d9749644f8e5e55a5d493d8127e4c9e17c7536eb31df2f589edc7f6fcbafa06d8b78ab3858ebefcb28421f6be0c7bd395378186a9a2e3b062ea6ad8ddae81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe

Filesize
468KB

MD5
88075201cc267623c31bf3dd9a284df7

SHA1
35d095df837d544e7f867948bc778b82b58668ba

SHA256
844ef4be4ef44e0da048f6b621ea1191365b8bfc7a5c63d0014b983eaf5eb6b9

SHA512
75cfd0f012ff056216eb8f52e807e63b417c52f61d4aa00bfb4ad7f02d200b471d4bf2bfd1e1d6112175124d43ad0978432c8c002c7f0a0c2eb82f5f9266a673

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9236.exe

Filesize
468KB

MD5
fbc455adbe984b1f14677c2bf81601ab

SHA1
fce8e47b527ef197f28eeff68ec1466c117a8243

SHA256
583bcbe6510bf89b72f605db051e5a42ee040abf67a7282090854650f74d0a32

SHA512
2666404a6cbb3b74e0912bccdfb551767b7ecc562efdfc683f9b2f08a5bf0e9731f9617423a5909f603f84b8154c243a0fdaee326738ed0e291611cec1b820ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe

Filesize
468KB

MD5
abbed5b02c3194898c37560049346c19

SHA1
43583b86c438e70446413751c4acfbecf5e847b3

SHA256
a292e819763b5ae9c30b1b1058f4020f6007caa0d641f887b17d0fcae5c51ff8

SHA512
bfb6621e97113811310305d2eb7d69e1cfce652acd067f65a8176e0d1b307eeb0cd3f99997d91887a54962c24287339f84b5e3565eccb4b7fb55c17ccc1f8a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe

Filesize
468KB

MD5
28efc57064c50ee146045b36cd0234e4

SHA1
3db32f3c450bcc3377ce80296469f452d92c4550

SHA256
fe352394716b5e0e34eb18a5e3285d98fc82618b2b99e8b38560c41f533e9e0a

SHA512
e8c5550476f7f50a96428c6d4bd0a743bb4a4b27bb1b83f9ae42da9bc833c39c7cf2b0392d08df08d9f68f8fc60a88bfc6f17b19bb35f1b833941aecc20bdf40

Download Submit
memory/60-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/220-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/572-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1940-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2492-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2944-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3152-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3704-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3764-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5552-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5616-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9532-3465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14412-2497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15008-2464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads