bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe
Size

468KB
MD5

a96aec42997b5675db65a7faeadb9790
SHA1

948e005146e5674f57c8f5dfca04f136f04749c2
SHA256

bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9
SHA512

9ad73c9b12ca5d266086ea27ae864b5f0e996c1bc393ff6d9262ba57c046df9dc9ce49d2144111c27966457ff36432118035816525543ebb678d3736fb7995d1
SSDEEP

3072:3hrtohKxj2TU2JYZBz35qfr3EC3jyvpUPjfI5VuVcYU+q9eNtblw:3hZo6YU2sBD5qfMh7ecYjSeNt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1664	Unicorn-61082.exe
3548	Unicorn-52442.exe
2276	Unicorn-7880.exe
4872	Unicorn-25280.exe
3572	Unicorn-45146.exe
4024	Unicorn-14319.exe
4360	Unicorn-61482.exe
2340	Unicorn-31026.exe
1272	Unicorn-41232.exe
208	Unicorn-6329.exe
776	Unicorn-11736.exe
4960	Unicorn-47938.exe
1724	Unicorn-39505.exe
1984	Unicorn-31410.exe
5004	Unicorn-11544.exe
4592	Unicorn-63418.exe
2820	Unicorn-39490.exe
764	Unicorn-19624.exe
3128	Unicorn-55561.exe
4644	Unicorn-11264.exe
4936	Unicorn-33242.exe
1876	Unicorn-33242.exe
2612	Unicorn-39298.exe
2380	Unicorn-46049.exe
4384	Unicorn-33050.exe
1952	Unicorn-45857.exe
1860	Unicorn-11159.exe
4044	Unicorn-41794.exe
2500	Unicorn-24695.exe
2212	Unicorn-59976.exe
976	Unicorn-57938.exe
4628	Unicorn-17394.exe
4392	Unicorn-46537.exe
4860	Unicorn-25754.exe
5116	Unicorn-62297.exe
3136	Unicorn-33346.exe
4836	Unicorn-5312.exe
2312	Unicorn-33154.exe
436	Unicorn-26906.exe
3700	Unicorn-35650.exe
4304	Unicorn-21351.exe
1532	Unicorn-59392.exe
3216	Unicorn-2593.exe
3316	Unicorn-30968.exe
4520	Unicorn-18546.exe
964	Unicorn-1633.exe
2564	Unicorn-61040.exe
1016	Unicorn-51026.exe
232	Unicorn-58929.exe
4816	Unicorn-33728.exe
3284	Unicorn-39328.exe
2080	Unicorn-408.exe
216	Unicorn-20274.exe
4016	Unicorn-29978.exe
212	Unicorn-20850.exe
2992	Unicorn-25488.exe
3124	Unicorn-4321.exe
672	Unicorn-58161.exe
1172	Unicorn-36994.exe
644	Unicorn-28826.exe
4460	Unicorn-61233.exe
1396	Unicorn-19698.exe
4432	Unicorn-21735.exe
3536	Unicorn-21735.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7176	5320	WerFault.exe	199
8868	6800	WerFault.exe	322

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35361.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35650.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1488	dwm.exe
Token: SeChangeNotifyPrivilege	1488	dwm.exe
Token: 33	1488	dwm.exe
Token: SeIncBasePriorityPrivilege	1488	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe
1664	Unicorn-61082.exe
3548	Unicorn-52442.exe
2276	Unicorn-7880.exe
4872	Unicorn-25280.exe
4024	Unicorn-14319.exe
3572	Unicorn-45146.exe
4360	Unicorn-61482.exe
2340	Unicorn-31026.exe
1272	Unicorn-41232.exe
208	Unicorn-6329.exe
776	Unicorn-11736.exe
4960	Unicorn-47938.exe
1724	Unicorn-39505.exe
1984	Unicorn-31410.exe
5004	Unicorn-11544.exe
4592	Unicorn-63418.exe
764	Unicorn-19624.exe
4936	Unicorn-33242.exe
1876	Unicorn-33242.exe
3128	Unicorn-55561.exe
2612	Unicorn-39298.exe
2380	Unicorn-46049.exe
4384	Unicorn-33050.exe
1860	Unicorn-11159.exe
4044	Unicorn-41794.exe
2500	Unicorn-24695.exe
976	Unicorn-57938.exe
2212	Unicorn-59976.exe
4644	Unicorn-11264.exe
2820	Unicorn-39490.exe
1952	Unicorn-45857.exe
4628	Unicorn-17394.exe
4392	Unicorn-46537.exe
4860	Unicorn-25754.exe
5116	Unicorn-62297.exe
3136	Unicorn-33346.exe
4836	Unicorn-5312.exe
2312	Unicorn-33154.exe
436	Unicorn-26906.exe
3700	Unicorn-35650.exe
4304	Unicorn-21351.exe
1532	Unicorn-59392.exe
3216	Unicorn-2593.exe
3316	Unicorn-30968.exe
964	Unicorn-1633.exe
2564	Unicorn-61040.exe
1016	Unicorn-51026.exe
232	Unicorn-58929.exe
4520	Unicorn-18546.exe
2080	Unicorn-408.exe
216	Unicorn-20274.exe
4016	Unicorn-29978.exe
4460	Unicorn-61233.exe
1396	Unicorn-19698.exe
4432	Unicorn-21735.exe
1172	Unicorn-36994.exe
3124	Unicorn-4321.exe
3536	Unicorn-21735.exe
2992	Unicorn-25488.exe
644	Unicorn-28826.exe
3284	Unicorn-39328.exe
4816	Unicorn-33728.exe
672	Unicorn-58161.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1664	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	82
PID 2060 wrote to memory of 1664	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	82
PID 2060 wrote to memory of 1664	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	82
PID 1664 wrote to memory of 3548	1664	Unicorn-61082.exe	83
PID 1664 wrote to memory of 3548	1664	Unicorn-61082.exe	83
PID 1664 wrote to memory of 3548	1664	Unicorn-61082.exe	83
PID 2060 wrote to memory of 2276	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	84
PID 2060 wrote to memory of 2276	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	84
PID 2060 wrote to memory of 2276	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	84
PID 1664 wrote to memory of 4872	1664	Unicorn-61082.exe	85
PID 1664 wrote to memory of 4872	1664	Unicorn-61082.exe	85
PID 1664 wrote to memory of 4872	1664	Unicorn-61082.exe	85
PID 3548 wrote to memory of 3572	3548	Unicorn-52442.exe	86
PID 3548 wrote to memory of 3572	3548	Unicorn-52442.exe	86
PID 3548 wrote to memory of 3572	3548	Unicorn-52442.exe	86
PID 2060 wrote to memory of 4024	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	87
PID 2060 wrote to memory of 4024	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	87
PID 2060 wrote to memory of 4024	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	87
PID 2276 wrote to memory of 4360	2276	Unicorn-7880.exe	88
PID 2276 wrote to memory of 4360	2276	Unicorn-7880.exe	88
PID 2276 wrote to memory of 4360	2276	Unicorn-7880.exe	88
PID 4872 wrote to memory of 2340	4872	Unicorn-25280.exe	89
PID 4872 wrote to memory of 2340	4872	Unicorn-25280.exe	89
PID 4872 wrote to memory of 2340	4872	Unicorn-25280.exe	89
PID 1664 wrote to memory of 1272	1664	Unicorn-61082.exe	90
PID 1664 wrote to memory of 1272	1664	Unicorn-61082.exe	90
PID 1664 wrote to memory of 1272	1664	Unicorn-61082.exe	90
PID 3572 wrote to memory of 208	3572	Unicorn-45146.exe	91
PID 3572 wrote to memory of 208	3572	Unicorn-45146.exe	91
PID 3572 wrote to memory of 208	3572	Unicorn-45146.exe	91
PID 3548 wrote to memory of 776	3548	Unicorn-52442.exe	92
PID 3548 wrote to memory of 776	3548	Unicorn-52442.exe	92
PID 3548 wrote to memory of 776	3548	Unicorn-52442.exe	92
PID 4024 wrote to memory of 4960	4024	Unicorn-14319.exe	93
PID 4024 wrote to memory of 4960	4024	Unicorn-14319.exe	93
PID 4024 wrote to memory of 4960	4024	Unicorn-14319.exe	93
PID 2060 wrote to memory of 1724	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	94
PID 2060 wrote to memory of 1724	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	94
PID 2060 wrote to memory of 1724	2060	bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe	94
PID 4360 wrote to memory of 1984	4360	Unicorn-61482.exe	95
PID 4360 wrote to memory of 1984	4360	Unicorn-61482.exe	95
PID 4360 wrote to memory of 1984	4360	Unicorn-61482.exe	95
PID 2276 wrote to memory of 5004	2276	Unicorn-7880.exe	96
PID 2276 wrote to memory of 5004	2276	Unicorn-7880.exe	96
PID 2276 wrote to memory of 5004	2276	Unicorn-7880.exe	96
PID 2340 wrote to memory of 4592	2340	Unicorn-31026.exe	97
PID 2340 wrote to memory of 4592	2340	Unicorn-31026.exe	97
PID 2340 wrote to memory of 4592	2340	Unicorn-31026.exe	97
PID 1272 wrote to memory of 2820	1272	Unicorn-41232.exe	98
PID 1272 wrote to memory of 2820	1272	Unicorn-41232.exe	98
PID 1272 wrote to memory of 2820	1272	Unicorn-41232.exe	98
PID 4872 wrote to memory of 764	4872	Unicorn-25280.exe	99
PID 4872 wrote to memory of 764	4872	Unicorn-25280.exe	99
PID 4872 wrote to memory of 764	4872	Unicorn-25280.exe	99
PID 1664 wrote to memory of 3128	1664	Unicorn-61082.exe	100
PID 1664 wrote to memory of 3128	1664	Unicorn-61082.exe	100
PID 1664 wrote to memory of 3128	1664	Unicorn-61082.exe	100
PID 208 wrote to memory of 2612	208	Unicorn-6329.exe	101
PID 208 wrote to memory of 2612	208	Unicorn-6329.exe	101
PID 208 wrote to memory of 2612	208	Unicorn-6329.exe	101
PID 3572 wrote to memory of 4644	3572	Unicorn-45146.exe	102
PID 3572 wrote to memory of 4644	3572	Unicorn-45146.exe	102
PID 3572 wrote to memory of 4644	3572	Unicorn-45146.exe	102
PID 776 wrote to memory of 4936	776	Unicorn-11736.exe	103

C:\Users\Admin\AppData\Local\Temp\bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe
"C:\Users\Admin\AppData\Local\Temp\bdc53e99f436035710129c59f1b4e86960f0783843f8a09c4dc624ff2effdfe9N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        8⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44729.exe
        8⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53976.exe
        8⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49113.exe
        8⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        9⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31210.exe
        10⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25655.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41952.exe
        8⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
        9⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42953.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37968.exe
        8⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23736.exe
        7⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5312.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        9⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        9⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44690.exe
        9⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2407.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35906.exe
        9⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40008.exe
        9⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
        8⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8272.exe
        7⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22306.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46922.exe
        9⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        8⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46602.exe
        9⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        9⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45019.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54705.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50385.exe
        6⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4833.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
        7⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22327.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10160.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8657.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25794.exe
        8⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        8⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11224.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        7⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        9⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36248.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        8⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        7⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61090.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2047.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        7⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40448.exe
        6⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56322.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57634.exe
        9⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        9⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21135.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25673.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        8⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53681.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28919.exe
        7⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33296.exe
        6⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        7⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11631.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54802.exe
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20544.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2231.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        6⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        5⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11097.exe
        5⤵
        
        PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43250.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        8⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65305.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34767.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7665.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21344.exe
        7⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        6⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22218.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37960.exe
        7⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        7⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46368.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39554.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40664.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14208.exe
        6⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53154.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        7⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41616.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        6⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30968.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39114.exe
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60650.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5409.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5345.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        9⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
        8⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4967.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26704.exe
        7⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62320.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55458.exe
        7⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63217.exe
        6⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        7⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        6⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        7⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21336.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48360.exe
        5⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38018.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27664.exe
        6⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29098.exe
        7⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1343.exe
        6⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41329.exe
        6⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48416.exe
        5⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29467.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        6⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36562.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13464.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        7⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31760.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46570.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5489.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57577.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        7⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29738.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        7⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44114.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        6⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
        5⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-0.exe
        5⤵
        
        PID:14492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        6⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26866.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4832.exe
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21224.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36919.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50962.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38482.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        7⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        6⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37975.exe
        5⤵
        
        PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12704.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        5⤵
        
        PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14049.exe
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
      4⤵
      PID:15072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25280.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29794.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        9⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        8⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        9⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28599.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        9⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16065.exe
        9⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41209.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        8⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46992.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60203.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3001.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        9⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        8⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24743.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47001.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-895.exe
        8⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31495.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        6⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61418.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9441.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        8⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
        8⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40824.exe
        7⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        7⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10664.exe
        7⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11673.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32024.exe
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        7⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53672.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        6⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55058.exe
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61994.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8817.exe
        9⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        9⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        8⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54504.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32642.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        7⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45216.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        7⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13777.exe
        7⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18448.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62123.exe
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57096.exe
        5⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6545.exe
        6⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39146.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
        7⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        6⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47889.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49832.exe
        5⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        6⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18328.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6576.exe
        5⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13834.exe
        6⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51994.exe
        6⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57402.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        8⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22840.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19408.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38008.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35448.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35672.exe
        7⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7935.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64193.exe
        6⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24536.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        6⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58656.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59841.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        5⤵
        
        PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27106.exe
        5⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64594.exe
        6⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15986.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21239.exe
        7⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57058.exe
        7⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        5⤵
        
        PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51345.exe
      4⤵
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
        5⤵
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8601.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        6⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        5⤵
        
        PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64146.exe
        5⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12657.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40776.exe
        6⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7696.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55082.exe
      4⤵
      PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13529.exe
        5⤵
        
        PID:12744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56063.exe
      4⤵
      PID:12712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20850.exe
        5⤵
        Executes dropped EXE
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        6⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 488
        7⤵
        Program crash
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        6⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14065.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        7⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        6⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36664.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33266.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56864.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36327.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65144.exe
      4⤵
      PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55561.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51226.exe
        5⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        6⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        7⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62721.exe
        6⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36138.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1744.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        6⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57890.exe
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19912.exe
        6⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        5⤵
        
        PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40104.exe
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        7⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44682.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35488.exe
        7⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        6⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62962.exe
        7⤵
        
        PID:16200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31969.exe
        5⤵
        
        PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
        5⤵
        
        PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27607.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5449.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51057.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35231.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
      4⤵
      PID:15532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38922.exe
      4⤵
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42322.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64833.exe
        5⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49755.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        7⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36320.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        5⤵
        
        PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
      4⤵
      PID:15876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
    3⤵
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59218.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60722.exe
        5⤵
        
        PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
      4⤵
      PID:16096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
    3⤵
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63946.exe
      4⤵
      PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
      4⤵
      PID:3604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
    3⤵
    PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      4⤵
      PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3362.exe
        5⤵
        
        PID:15992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7184.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
    3⤵
    PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42666.exe
    3⤵
    PID:16044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48938.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26202.exe
        9⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        9⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        8⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57265.exe
        8⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12895.exe
        8⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31170.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1993.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        7⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11967.exe
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        7⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65113.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10057.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        6⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43202.exe
        7⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52050.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42888.exe
        7⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45745.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42968.exe
        6⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9648.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        6⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        7⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62377.exe
        6⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48608.exe
        5⤵
        
        PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19698.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45777.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19767.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        6⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52602.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52322.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54681.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        8⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
        8⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56961.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12313.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        7⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53889.exe
        6⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        7⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29495.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20711.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63866.exe
        6⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24490.exe
        7⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8561.exe
        8⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60545.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        5⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
        6⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7217.exe
        8⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        6⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48777.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39170.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        7⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2616.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26599.exe
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35569.exe
        5⤵
        
        PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21834.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24975.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        5⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        6⤵
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64681.exe
        5⤵
        
        PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14856.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49162.exe
      4⤵
      PID:14720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        6⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        7⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59737.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6985.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35273.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12585.exe
        6⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4817.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7113.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64385.exe
        6⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48578.exe
        6⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29498.exe
        7⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13000.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16319.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
        5⤵
        
        PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21066.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        6⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        5⤵
        
        PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51081.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3633.exe
        5⤵
        
        PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64256.exe
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
      4⤵
      PID:14900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        5⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
        7⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25585.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28010.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16347.exe
        5⤵
        
        PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25792.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        5⤵
        
        PID:1388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51529.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58345.exe
        5⤵
        
        PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27047.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59234.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38920.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59569.exe
        5⤵
        
        PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20048.exe
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17354.exe
      4⤵
      PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58730.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26482.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48641.exe
        6⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
        5⤵
        
        PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7256.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        5⤵
        
        PID:14960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14183.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30378.exe
        5⤵
        
        PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
      4⤵
      PID:13488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
    3⤵
    PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9545.exe
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8905.exe
        6⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48753.exe
        5⤵
        
        PID:15916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30049.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-183.exe
      4⤵
      PID:14036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10225.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        5⤵
        
        PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54209.exe
      4⤵
      PID:12704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11913.exe
    3⤵
    PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
    3⤵
    PID:13460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50545.exe
    3⤵
    PID:7272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45738.exe
        6⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22690.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31450.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        8⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13367.exe
        7⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
        9⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        8⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36840.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38080.exe
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29800.exe
        7⤵
        
        PID:15980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13527.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39810.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62585.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45537.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        7⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4145.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        6⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9296.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53714.exe
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43002.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63057.exe
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42736.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2215.exe
        6⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21480.exe
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64640.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
        5⤵
        
        PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39416.exe
      4⤵
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27418.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42642.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        7⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        6⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21522.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        7⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6848.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27576.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        5⤵
        
        PID:6800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 552
        6⤵
        Program crash
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16648.exe
        5⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27000.exe
        5⤵
        
        PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56441.exe
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63458.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48049.exe
        5⤵
        
        PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
      4⤵
      PID:14660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        5⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
        7⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34242.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        6⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2751.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58169.exe
      4⤵
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56929.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6769.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        7⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        6⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8080.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57665.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3311.exe
      4⤵
      PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4392.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64952.exe
      4⤵
      PID:13608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
      4⤵
      PID:4804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56170.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        5⤵
        
        PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33119.exe
      4⤵
      PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        5⤵
        
        PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49016.exe
      4⤵
      PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44481.exe
      4⤵
      PID:15252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54225.exe
    3⤵
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56826.exe
        5⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19575.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
      4⤵
      PID:13340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65280.exe
    3⤵
    PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
    3⤵
    PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1049.exe
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
    3⤵
    PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
    3⤵
    PID:2940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25410.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35480.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        7⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        7⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43081.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
        7⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27058.exe
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64593.exe
        7⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10047.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63138.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17601.exe
        6⤵
        
        PID:744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34785.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
        5⤵
        
        PID:15896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43738.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12721.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51898.exe
        8⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29528.exe
        7⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        6⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54553.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        5⤵
        
        PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21850.exe
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2584.exe
        5⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29866.exe
        6⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
        5⤵
        
        PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      4⤵
      PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59010.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36984.exe
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59600.exe
        5⤵
        
        PID:15308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35896.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33072.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60657.exe
        5⤵
        
        PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
      4⤵
      PID:15220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44712.exe
    3⤵
    PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20298.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60770.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        5⤵
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4688.exe
      4⤵
      PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45074.exe
        5⤵
        
        PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10575.exe
      4⤵
      PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27433.exe
    3⤵
    PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
    3⤵
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
    3⤵
    PID:14836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61506.exe
      4⤵
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        5⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5625.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        6⤵
        
        PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-407.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31480.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9073.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14945.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        6⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        5⤵
        
        PID:13960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10919.exe
      4⤵
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17775.exe
      4⤵
      PID:14496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-608.exe
    3⤵
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47698.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37576.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        5⤵
        
        PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54065.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27105.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5296.exe
      4⤵
      PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49248.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
    3⤵
    PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
      4⤵
      PID:16344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
    3⤵
    PID:10808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
    3⤵
    PID:15352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6561.exe
      4⤵
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7120.exe
      4⤵
      PID:11848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
    3⤵
    PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
      4⤵
      PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
    3⤵
    PID:11312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62338.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10297.exe
    3⤵
    PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8103.exe
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63633.exe
      4⤵
      PID:2540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38896.exe
    3⤵
    PID:8904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18272.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53111.exe
  2⤵
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
    3⤵
    PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9673.exe
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
      4⤵
      PID:15464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15760.exe
    3⤵
    PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
    3⤵
    PID:15444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
  2⤵
  PID:7904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48368.exe
  2⤵
  PID:10248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30545.exe
  2⤵
  PID:12992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29506.exe
    3⤵
    PID:16068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31496.exe
  2⤵
  PID:15676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50177.exe
  2⤵
  PID:16740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5320 -ip 5320
1⤵
PID:8144

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6800 -ip 6800
1⤵
PID:8316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe

Filesize
468KB

MD5
ad973d1fd347d184785f5361bbe5958c

SHA1
4fc8e7eee1d9db73d29694f22ac2c5fbc7b94e4f

SHA256
61b23bc0c8c05d1689fba4e0707d4676be7b2b01832ffa619de721de24830133

SHA512
063dbaff09107771dc2e13924def98ea2a3e56989eff080cc989be20b0efb7a285a3676842fad19e874c69d3517979ba004506101d7e6fc1a47daf0e7587fba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11264.exe

Filesize
468KB

MD5
52c1f8df3ac2ea5fc12f4345de2e78fe

SHA1
7747d0a84cb975cca6c1636123d7ed4ed00a3894

SHA256
5f07fd17b1206b1bbab732cba344ea1a3eddf2b68a3dc488790d625e29a97413

SHA512
0d4080c424e62a548a19361b6c606671c040fb6ba3ea3b6e24c9ac645f4f580ac67b36807383b247ee6537c81c65daaa51bd41627c52c0cf9233be146d2ffc14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe

Filesize
468KB

MD5
8d7298c0e17b751fe4fd976079639324

SHA1
9312496554bca1042fb914877fa8a492900eaded

SHA256
fca59025a9a0a94aabe17bfe0b7902607a8f4bb4296d8feaba94c791cb1caef4

SHA512
dd331166860718e7972daab7a759b93b6995d24dab432a9dc52924d0255674409ddfb7afca55083db31f179c4b82f22086e24dd79cc7fcbd325566c3a309743f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe

Filesize
468KB

MD5
2bd7c4811df95611098fcf0806ae30ad

SHA1
736460016cafe766fed1443639acc8845a5ae42f

SHA256
b2be34545d2836ac00ff0f7654e52728be9cef583693e0ae65adbfccaeb6aee5

SHA512
7d2a993486ab786ec10b7cef5fd90c0b2a79b25e9462c376001ed32340e9112c511b8ce1e2d9420efe4bde4835351187186e0fe1ef05798215c28bc39e243a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14319.exe

Filesize
468KB

MD5
9788129b6138fbb6135c8d3e1bb5f923

SHA1
cc95973982d9f9063467e1cd70b9c478793f0b8e

SHA256
0b0886f8b73a4e8e36a59d68efa2b935c23a0e8c37b0fb4026e30ec31c759235

SHA512
e7c28597d2545300fb7f494696ccc94ae8a4e40b9f1c0bbd7c741091ace3ca84ceced43b916826a453cd6c016fb0e1d23d4e842139e1a986c97bffe6b37681b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe

Filesize
468KB

MD5
4665b03c69453df84576bd677180ec86

SHA1
758fb0ccab4aedf32bd5b4f57eac4774e0bfdcec

SHA256
a49b845584902e87cbbfc31fbd94f89f96eb089f09546a89db2041bc4fce92e5

SHA512
e3049a303bbdaf6f3ade86aa79a147ae30cb0bb76d6baaa9910f06a867ecbe1cac385dc763305bba1cf324a586fd1d3a98db8906f2094c311cafa9acdab3fb53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe

Filesize
468KB

MD5
3b33e740667ab33413d1fd9c65cd99b1

SHA1
77393cc6caeca5e6ceec205b1d4ead0fca23ccec

SHA256
5599acdca589eb590a77f2cc11f175b2056c5d7261fe16a922005519729a23c5

SHA512
54cb308fcb71113130cdb102ddb0612778ecb2054df18e2ce032025c401bc162ad5dd3bb982997dcdbfd895f9ed155ffe73d53ce7c05625464f9c19d721a2ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe

Filesize
468KB

MD5
44db5717f42eb4db2a1f31e8a237e67f

SHA1
0cbfc372c9474f3fbfcb5b20420cdfe7ad4329e6

SHA256
1834f52fd35795076804b9801845c25e6661cc05fc6490f149b557bd020270b4

SHA512
50a508ca663c3046b70a60a57dbb8a953497def44825db5265ad962cdd4ce521db615fbc0b2a5cd06f66bb2de3c0cac17bc04ef3af3aba5e6a8d3a3f97a4aa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25280.exe

Filesize
468KB

MD5
8771f195ce5be602c57f0c2d463a31ee

SHA1
91b42d33898bf25bd4f13921e5c8b08fd293e17d

SHA256
5c81c79df5be197341aff5cd842a69dbe665af0d238716995c03694856ceabbc

SHA512
25274af68ea04fd335d4d43741bbb521dccb12886dd01fc4ce5179c2a1cb0e021973dd899cfe7e5c1dce0e4fc527d1df10550ab7671ca9b24d4271bf764906f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe

Filesize
468KB

MD5
9f1d4de08fc30024f9f76294a7099a35

SHA1
75e351259557f7abbccbf39a2ff4baae6468ef91

SHA256
23089cf7a798098b4cb5909d85c639b9e0b9b8026652c59e17c0ea45c47a5f9e

SHA512
898625d9432df455b744cb853a627eab6eca3cf3d0091c5c6e48825bf9824e85c864dfa984d6da3b834fca9650df9c21e0c776ccf2bab6d8858855aa5ae435b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe

Filesize
468KB

MD5
753ec2c1412a5992caff7064a5f7c283

SHA1
2325b471214dede0bdbe36a0b1dae88ed881f3b2

SHA256
4a07690a57ebb18e2f9b21778742a6aa6690acd83d2da4a610b3e7cd7e5d9e84

SHA512
9e5046545a8ffec9807e672b125a63502123859698a44b9194bff0c91c60d4084dd83c90c3ae8165caf9acce0d21197f6ec597310c03970dc17640d60916ac44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe

Filesize
468KB

MD5
c2938c5ef7be82510171eebcf016f40f

SHA1
dbe7d6102adc4d3368ba95d959ebedbbcdeea2a9

SHA256
263008a68a91877a283e429fe902cbf03b26bc86941e8850b6955fb952c97fd7

SHA512
b3a27595420ca141271f993d159b6e5a5b5b88e79b6bd3ae54860d774e2903e800f04f7ddcd9b0598e42d4ebcd0f7facd771aa8f8d88f1034a5c28b639267b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe

Filesize
468KB

MD5
e4f8f340d84c860d106f839a52cb51c7

SHA1
51f435ebbccce1267b957172ffead19bd67863c3

SHA256
3f1dd7305961c58b20b38721fc9a0e2da30b8a3f24efeca6916939bf300ab752

SHA512
d6c1ec4c8488c099df1294831cb077b238c53c8473293686e34d02c13ad9ac2debd442f42d3e0e3c43d05d76b6964f859ec8d35127ae0fe52553e7aed15a02c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39298.exe

Filesize
468KB

MD5
ca3eba70058254c2a9e2fe6abefd47f7

SHA1
3224982bf9ed8f3f72f63b3eeab1e2bee4e50450

SHA256
60c6d86893aa4c1132b63163813642ffe62d5adc36d97d650d451e4b9f869b59

SHA512
0a94677d65dbd0b37951180b3db2fff53aaa439b5664911b3c60269a1e78e3b8381d98935d4304f08f401c3a6d6b4c77b8333921a6a0fc971f0386abaf8903a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39490.exe

Filesize
468KB

MD5
ee7fa335694c45e32c2136913447b897

SHA1
be5c74415d4c5506093ad652ba7ca2d17b1f276e

SHA256
c80e83a159a23b205fb1c91323f0cfe629964cf98ef4fbb42c81d28c88378f13

SHA512
4a8d4c5308fc13156b3b08fe17f0e78cd849e02685ad09cf6cf5132693dc8814e49b41fc35e1a872393efb3090b8b1845fbb2ae1321c58a86209f764b336ef76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39505.exe

Filesize
468KB

MD5
f71fa85fe6fbf43c03214b4c3daf56c0

SHA1
aac60b7ba13285ab06a041eac98822318f5caf86

SHA256
492456a445f101eb7193be2fe2ff3aa4588a2f3a38a921d4be1ecd78d122c5b1

SHA512
12e545c0bacb19f034423c580424d15a15b2ffbb645873435bb29a85624b18a1574d2c54a98a78afb1d937e0ac5b84ee6a508861d2d050e8dfbc024860eb29b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe

Filesize
468KB

MD5
2d7aae7cb7291089da8f234ce1c2a498

SHA1
544fe317911d75c1f10160f78955c4fb7e9c8e00

SHA256
60578bfc6d65179527f6e5ccb11ad4692e226dede88e6ba0d2ab6cb577c038ed

SHA512
7c769bc544b1f99635cf66e878c1bfb389321f8d496ea9e71c1b8f0048eef46f8d75971452bc28098b94bf57bd5ba2c495e4b04ca98c2e769db4086932150752

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe

Filesize
468KB

MD5
273deafb0ff254811aab1036f6eb1125

SHA1
72ac48bbc16ef1cf041ebc15f5e25515406abe1c

SHA256
777deba84dad49fcf16f12a07f47b0d042eecd1f743fba91430d63916e0d476e

SHA512
dbc825abf687225baad33f7667a5020fcb32fe91ab4709de0bd4d5f4242ff51c21319acea48b63f81770dd407b7bbf05b0833c9dce6abd4e59cb5c1f4589bb42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe

Filesize
468KB

MD5
8643b5396df7d4eea3d0e11159343bc9

SHA1
b7cc83c64e17f5e386a586c9efc23d3a324f49b4

SHA256
30717e1f657c1b5e4128b642423bf1ba88c799520180c7357519282fd6a9299d

SHA512
d8970f35a82180a0c26d730a125aea7ab6af8451db6601a04383de4a667d3b8be6afa80794f2f262e4393ff3227f3c8cce0f2c9d20f2f717c4f9ef5f912fd6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe

Filesize
468KB

MD5
d375d872c9a99c3ad9cbb97755aa5e70

SHA1
8253ba4908fe3af468b42d142e68b26bd0cc783f

SHA256
4d4ef826201a8f0c0432932fe44dc66ab5199d98b89e0568c127aa180b35f14f

SHA512
e8b174ffd94f79822d8c464b0357c07b7eae46d5b5998f8002d030139028234cb87ca4d1c96e197c7a728ae80226909ce444aec3ce96de1db639f43921b734e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe

Filesize
468KB

MD5
5697bcff20bbc3a3fd1a0a6be15f95c5

SHA1
c15ff5ff7684af1b1047df922f512aaaab43cd34

SHA256
df94d82f80512be8c1f7c28fd1a95de8e56658382bb6c1d793de2df862f4723b

SHA512
01ba766370a3a36fda4bc878d8e16a1845df33e3114fad6eaabb0f824f25a9f1316fbd80a2b3c0fb4b6dc01cfbdbfa96583d9f02333010a5fc6e265b3f2bae4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46049.exe

Filesize
468KB

MD5
ef7c120fe946148a70821d6b37617d5d

SHA1
daa0ffcb6903ae6f6128b9d9d120d95801f6f3a1

SHA256
6f22abaf1642284ae4dcc9ad701993fd4f8f115242179fd52679accd90fc7128

SHA512
906e0fc0cc82dc50de653d9e23894aae603a9d1193411325b04d3f5e871a1cb743b37d9ee4ba429fae0d76b937e47528a4a39efbbc7e3e411363ecb4c64bc667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe

Filesize
468KB

MD5
3ca535d0eb447f07489f3fc44c679409

SHA1
30b7f49765fc66410ceb8ff2be12a918121691d9

SHA256
3ffe58f8bfbc8454c7e1e91bab3c7ac347e648f6a4898aeb7e5af3a3507b9d33

SHA512
445154cc970de4a09030e12ff0fc1b97f750df6498e6a6e3f195ce0603d75aaf6f1dc285313ed8922b5fb54129a84d5768281eb547a5d3b75e500dda2a987f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47938.exe

Filesize
468KB

MD5
c8c2ef86322a31e7b4da671112f6bacf

SHA1
0bd06a40927bc97483b5e8dcd756a935d802114c

SHA256
f70ecb87c100421c3edad1ecaddd178a84e7bb113528eeccc144039a36a26069

SHA512
c2970d8631b431156e469f25d82644c02cd2f44ccad8e720ced3e69da69d50e293f633305cf9ac7b97493b984693429eeb870de208bbd787a0b816e96876b2ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52209.exe

Filesize
468KB

MD5
1acef29194dcc45d98380712d6818dd1

SHA1
bacbcf61ee2d79718527c3340be90a2dc0ea291f

SHA256
01782c0f7e5eee990a5533e7693e4decbcb60440b5ecc86d0fb359fff8f6dc8a

SHA512
40f31a634c2be3d882fed8ab8d6835042f8d7f5b812a4872fac44654fd311050ff0eeb4d1ba9baf388107a9f23c69e013f7231ad5b31cad0a78289759fffb9fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52442.exe

Filesize
468KB

MD5
c33d7f3b2a6ef01612f03fab7591dea5

SHA1
4e6a1df247e5b9f3c3e25c9794034aa152764de6

SHA256
dcd8ae2c1d3124daca67fbeb1f9fb2a36931d18154ee6ff28b83d2aab20f2951

SHA512
5a4653d141d5ec6db10baf7bbfbf8ca650fdcba502eb67deb2d2b8187ba78e931529decc72b1137228c8dcd848fb4943bba3b9e45365f20d9921346526e87182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52673.exe

Filesize
468KB

MD5
871aaa5317b8464778ff8cb9711b6d17

SHA1
aafef569ea99a47516971ca3d0d9c95242abe57d

SHA256
09f9a3afb06fbbff999170b127495079d3afc41567cc25fda014d312ce27e227

SHA512
b17ec49ed355c7f6d7cf7eeaa91b513f7b0aae7d67742b8b275365f075fbd634dedbbac6569c0afc29813ef79d178d35501726873c6855f4a4934507ad91f794

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55561.exe

Filesize
468KB

MD5
d602215ec4b6bc07f51f11d53a1b7fcd

SHA1
5871861e254064029c98b11145a5bb43b40ca23d

SHA256
abbab1b9973038e37af8a7066aa8d2d71ca494c9680c5b43dfe142194782caf4

SHA512
ac47b4f186bd9f8db9acdc99b892ff1e513e128d548be7aeb668a9cfc08427e551402d532a4a6096a83bb19ea99b47a0733e15919fdab67a5143ccf4c16f32a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57938.exe

Filesize
468KB

MD5
a0e264d11d983d65c92acb3833945c84

SHA1
ffdb0e3619a83b2e2f5d7901908766cac20956fc

SHA256
933aa3bf852b07edace0044ca752c681da8a239bbc6a82b29c36057424a58ed0

SHA512
58f69e1d4bcb782fda05e5e7d9bd2b43cf7aa43ddc8a607068451fbbe3a6b87cbf44910cbbd7562b293c01e9e7e3bb88c7f7d1ef96a048e7a77b70ba597a73a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe

Filesize
468KB

MD5
0648a59b04f1c92d5d57f8a2adc6e326

SHA1
f623e488e8c7a66ee34a8d85a03e2052d8f164c1

SHA256
74589eb9e76cf70a769c705512ff0b383ce3ceeeae697d2f1328128c41b59efd

SHA512
1749c6491dd185b5c0323c149bd293e397e48d4207eb494b7f23cd83a70cd19e2360a256b59813bfde3323b7ef9c2f4bc75087631c75eefd2e0deded24b65179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe

Filesize
468KB

MD5
7e46d04efd42a36ca3e97a2b2430b520

SHA1
367221a524dcf694e322280291f98bbd7b0c6f5c

SHA256
8d652cb9f1a5e17d1976d112145c72b0cce8dc2c8942ec86dec3aff657ef99e0

SHA512
646d4c7f90ca4acd5cab550d1f12fe91c470446c824ec33aac1a10da6c069a0255b6ccde60cc06ed9fb711eb41f7e2c47ad61d369217c01a38e4a31074c880fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61482.exe

Filesize
468KB

MD5
fb8fcf5b6ac703578e2c8b1d0c1efe1e

SHA1
4f65f02252a0295a6b0c87be9cc04a4322db065e

SHA256
7b5130c2582e17362fcb52c436d68ba0ee3da7add2eb401f8937de6522a00788

SHA512
28726b1df4a6c4d81abcaefbd05864e73be78e5ef478e429c5417d8d85a8844f235d52745ca3844a4dd1f9b7fa14a8364968750b5a6501932e384834c742108d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe

Filesize
468KB

MD5
8bd13366f6b57cac8f717bab6e5d2ea9

SHA1
95548f719ba1bcc16ecf8a88ccae88273295e617

SHA256
d54df4c6ccaf1427bc695c2d574bf01f69f4912e15dd40d5235308d6f8da484b

SHA512
e61b4d23641f05832504ceb0e4ab5c6bb0fb55c2e2f7e64b72f32ad741ee5bf11f2ed1c659d6a6d140cab904a4f15aeb35f2bc3fdabe4d1dc3a0df8a13917d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63418.exe

Filesize
468KB

MD5
6a737761f7f0b344cf009fe0ed8cd3cd

SHA1
dd66fbb1d08dbca042bb5cbbd24ed91e103f0b42

SHA256
23acc6b492f865523d01b522333b0d4c442e181f0ed42520813b76d340b8ef8e

SHA512
69b12156ebd8006f49f29c31d7f8133a208694c559bf962c1a89645f4d36029b883153895c94a58f295752c9cf717afe039ef0a493f886c6c2569bcd567682ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7880.exe

Filesize
468KB

MD5
0e4ab14f2cf6d0d0c626029ea429559b

SHA1
08be68e39dab6388069989452dc814ca5a166520

SHA256
f42efda0b8d7b98591fa99f6652ab66532a921581ae1a61d9de054fbcf5335ae

SHA512
351b979ce6427f18158cb9dbcc33928e3e1375ce80c8693fbf801f54f569ad17d26884b8ccb7894a57c79528da84b499bec044fe005c91cec1728fafd469dc59

Download Submit
memory/208-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/672-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/776-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/964-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1572-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2612-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2820-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6800-3342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads