e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142

Analysis

max time kernel
119s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe
Size

468KB
MD5

3a295694c7ba7be31e335851eda805b0
SHA1

758ae317f68436317bf7242129e92e19303f9dbd
SHA256

e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142
SHA512

2f3f66bf420d909170010ed1b130189db0b4ab21068ac4c2fc0cbd8d465b01c4f767c1c28e89d8d3a525331052b2a9096b603a91c65895aade2dc3c610a7679b
SSDEEP

3072:7+mnogcCj28U2by9P73/qf8/JDhjyIplPmHBNTDfG6P+uTSNrvlR:7+WooXU2kPr/qfv0spG6WUSNr

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4624	Unicorn-30297.exe
436	Unicorn-47313.exe
868	Unicorn-2066.exe
4092	Unicorn-24436.exe
4132	Unicorn-9168.exe
3112	Unicorn-54840.exe
1548	Unicorn-3038.exe
840	Unicorn-2832.exe
3692	Unicorn-18292.exe
2044	Unicorn-18026.exe
4820	Unicorn-27913.exe
3464	Unicorn-8047.exe
4852	Unicorn-21782.exe
3948	Unicorn-27913.exe
4508	Unicorn-14102.exe
208	Unicorn-38105.exe
5024	Unicorn-44634.exe
3932	Unicorn-62609.exe
3352	Unicorn-53564.exe
804	Unicorn-12531.exe
3952	Unicorn-18431.exe
4020	Unicorn-11187.exe
2032	Unicorn-25447.exe
1852	Unicorn-17087.exe
2776	Unicorn-61457.exe
4776	Unicorn-61192.exe
1732	Unicorn-39183.exe
4068	Unicorn-26668.exe
3716	Unicorn-42931.exe
4372	Unicorn-24486.exe
2176	Unicorn-58608.exe
880	Unicorn-32345.exe
872	Unicorn-61680.exe
5096	Unicorn-31468.exe
4488	Unicorn-37559.exe
4768	Unicorn-62132.exe
1200	Unicorn-43719.exe
2488	Unicorn-63585.exe
2316	Unicorn-21676.exe
4932	Unicorn-21676.exe
2188	Unicorn-4799.exe
4832	Unicorn-36860.exe
3316	Unicorn-5256.exe
2468	Unicorn-61556.exe
1124	Unicorn-61556.exe
2140	Unicorn-55426.exe
772	Unicorn-62817.exe
4668	Unicorn-64160.exe
4856	Unicorn-4223.exe
892	Unicorn-23212.exe
1728	Unicorn-15158.exe
512	Unicorn-24089.exe
3904	Unicorn-47908.exe
3408	Unicorn-1814.exe
1236	Unicorn-17958.exe
3252	Unicorn-24208.exe
3348	Unicorn-50404.exe
2544	Unicorn-1395.exe
1904	Unicorn-47067.exe
2656	Unicorn-11016.exe
1948	Unicorn-47451.exe
440	Unicorn-34369.exe
4420	Unicorn-20070.exe
4524	Unicorn-28238.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7100	5992	WerFault.exe	201

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17299.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3236	dwm.exe
Token: SeChangeNotifyPrivilege	3236	dwm.exe
Token: 33	3236	dwm.exe
Token: SeIncBasePriorityPrivilege	3236	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe
4624	Unicorn-30297.exe
868	Unicorn-2066.exe
436	Unicorn-47313.exe
4132	Unicorn-9168.exe
1548	Unicorn-3038.exe
4092	Unicorn-24436.exe
3112	Unicorn-54840.exe
3692	Unicorn-18292.exe
840	Unicorn-2832.exe
2044	Unicorn-18026.exe
3948	Unicorn-27913.exe
4852	Unicorn-21782.exe
4820	Unicorn-27913.exe
3464	Unicorn-8047.exe
4508	Unicorn-14102.exe
3932	Unicorn-62609.exe
804	Unicorn-12531.exe
3352	Unicorn-53564.exe
5024	Unicorn-44634.exe
208	Unicorn-38105.exe
1852	Unicorn-17087.exe
1732	Unicorn-39183.exe
4020	Unicorn-11187.exe
3952	Unicorn-18431.exe
4776	Unicorn-61192.exe
2776	Unicorn-61457.exe
2032	Unicorn-25447.exe
3716	Unicorn-42931.exe
4068	Unicorn-26668.exe
2176	Unicorn-58608.exe
4372	Unicorn-24486.exe
880	Unicorn-32345.exe
872	Unicorn-61680.exe
5096	Unicorn-31468.exe
4488	Unicorn-37559.exe
4768	Unicorn-62132.exe
1200	Unicorn-43719.exe
2316	Unicorn-21676.exe
2488	Unicorn-63585.exe
4932	Unicorn-21676.exe
2188	Unicorn-4799.exe
4832	Unicorn-36860.exe
1124	Unicorn-61556.exe
772	Unicorn-62817.exe
3316	Unicorn-5256.exe
2468	Unicorn-61556.exe
2140	Unicorn-55426.exe
1728	Unicorn-15158.exe
4668	Unicorn-64160.exe
512	Unicorn-24089.exe
3904	Unicorn-47908.exe
3408	Unicorn-1814.exe
892	Unicorn-23212.exe
4856	Unicorn-4223.exe
1236	Unicorn-17958.exe
3252	Unicorn-24208.exe
3348	Unicorn-50404.exe
1904	Unicorn-47067.exe
2544	Unicorn-1395.exe
2656	Unicorn-11016.exe
1948	Unicorn-47451.exe
4524	Unicorn-28238.exe
2680	Unicorn-362.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4624	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	86
PID 3832 wrote to memory of 4624	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	86
PID 3832 wrote to memory of 4624	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	86
PID 4624 wrote to memory of 436	4624	Unicorn-30297.exe	87
PID 4624 wrote to memory of 436	4624	Unicorn-30297.exe	87
PID 4624 wrote to memory of 436	4624	Unicorn-30297.exe	87
PID 3832 wrote to memory of 868	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	88
PID 3832 wrote to memory of 868	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	88
PID 3832 wrote to memory of 868	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	88
PID 436 wrote to memory of 4092	436	Unicorn-47313.exe	89
PID 436 wrote to memory of 4092	436	Unicorn-47313.exe	89
PID 436 wrote to memory of 4092	436	Unicorn-47313.exe	89
PID 868 wrote to memory of 4132	868	Unicorn-2066.exe	90
PID 868 wrote to memory of 4132	868	Unicorn-2066.exe	90
PID 868 wrote to memory of 4132	868	Unicorn-2066.exe	90
PID 4624 wrote to memory of 3112	4624	Unicorn-30297.exe	91
PID 4624 wrote to memory of 3112	4624	Unicorn-30297.exe	91
PID 4624 wrote to memory of 3112	4624	Unicorn-30297.exe	91
PID 3832 wrote to memory of 1548	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	92
PID 3832 wrote to memory of 1548	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	92
PID 3832 wrote to memory of 1548	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	92
PID 1548 wrote to memory of 840	1548	Unicorn-3038.exe	93
PID 1548 wrote to memory of 840	1548	Unicorn-3038.exe	93
PID 1548 wrote to memory of 840	1548	Unicorn-3038.exe	93
PID 4132 wrote to memory of 3692	4132	Unicorn-9168.exe	94
PID 4132 wrote to memory of 3692	4132	Unicorn-9168.exe	94
PID 4132 wrote to memory of 3692	4132	Unicorn-9168.exe	94
PID 3832 wrote to memory of 2044	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	95
PID 3832 wrote to memory of 2044	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	95
PID 3832 wrote to memory of 2044	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	95
PID 3112 wrote to memory of 4820	3112	Unicorn-54840.exe	96
PID 3112 wrote to memory of 4820	3112	Unicorn-54840.exe	96
PID 3112 wrote to memory of 4820	3112	Unicorn-54840.exe	96
PID 436 wrote to memory of 3464	436	Unicorn-47313.exe	97
PID 436 wrote to memory of 3464	436	Unicorn-47313.exe	97
PID 436 wrote to memory of 3464	436	Unicorn-47313.exe	97
PID 4624 wrote to memory of 4852	4624	Unicorn-30297.exe	99
PID 4624 wrote to memory of 4852	4624	Unicorn-30297.exe	99
PID 4624 wrote to memory of 4852	4624	Unicorn-30297.exe	99
PID 4092 wrote to memory of 3948	4092	Unicorn-24436.exe	98
PID 4092 wrote to memory of 3948	4092	Unicorn-24436.exe	98
PID 4092 wrote to memory of 3948	4092	Unicorn-24436.exe	98
PID 868 wrote to memory of 4508	868	Unicorn-2066.exe	100
PID 868 wrote to memory of 4508	868	Unicorn-2066.exe	100
PID 868 wrote to memory of 4508	868	Unicorn-2066.exe	100
PID 2044 wrote to memory of 208	2044	Unicorn-18026.exe	101
PID 2044 wrote to memory of 208	2044	Unicorn-18026.exe	101
PID 2044 wrote to memory of 208	2044	Unicorn-18026.exe	101
PID 3832 wrote to memory of 5024	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	103
PID 3832 wrote to memory of 5024	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	103
PID 3832 wrote to memory of 5024	3832	e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe	103
PID 3948 wrote to memory of 3932	3948	Unicorn-27913.exe	102
PID 3948 wrote to memory of 3932	3948	Unicorn-27913.exe	102
PID 3948 wrote to memory of 3932	3948	Unicorn-27913.exe	102
PID 3692 wrote to memory of 3352	3692	Unicorn-18292.exe	104
PID 3692 wrote to memory of 3352	3692	Unicorn-18292.exe	104
PID 3692 wrote to memory of 3352	3692	Unicorn-18292.exe	104
PID 840 wrote to memory of 804	840	Unicorn-2832.exe	105
PID 840 wrote to memory of 804	840	Unicorn-2832.exe	105
PID 840 wrote to memory of 804	840	Unicorn-2832.exe	105
PID 4092 wrote to memory of 3952	4092	Unicorn-24436.exe	106
PID 4092 wrote to memory of 3952	4092	Unicorn-24436.exe	106
PID 4092 wrote to memory of 3952	4092	Unicorn-24436.exe	106
PID 4852 wrote to memory of 4020	4852	Unicorn-21782.exe	107

C:\Users\Admin\AppData\Local\Temp\e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe
"C:\Users\Admin\AppData\Local\Temp\e04e62a8cb0228731fb513f2115e5e1503ce0bbe425618f1792ad224a69b7142N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56756.exe
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        10⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-963.exe
        10⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        10⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58399.exe
        9⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        9⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        9⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23200.exe
        9⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65223.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        9⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        9⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8430.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47552.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11301.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3059.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        7⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46152.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21676.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        8⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        9⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51195.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14030.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        7⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        8⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59375.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62969.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27836.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22699.exe
        9⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55185.exe
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31176.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60527.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        7⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8902.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14986.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        6⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50719.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28727.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29703.exe
        6⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23880.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        7⤵
        
        PID:16372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2565.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3070.exe
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16034.exe
        5⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        6⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        5⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        5⤵
        
        PID:14860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8047.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23212.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
        8⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13762.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        7⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27237.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53101.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32358.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20400.exe
        7⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16300.exe
        6⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        7⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        7⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        6⤵
        
        PID:14736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54687.exe
        7⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6555.exe
        6⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28315.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15339.exe
        6⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55731.exe
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        7⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        6⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        7⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30061.exe
        6⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20279.exe
        5⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17473.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        7⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43798.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61022.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21857.exe
        6⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23023.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        5⤵
        
        PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4799.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26305.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19969.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3838.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        6⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53649.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        5⤵
        
        PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4249.exe
        5⤵
        
        PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32750.exe
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        5⤵
        
        PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46259.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        5⤵
        
        PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20300.exe
      4⤵
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45197.exe
      4⤵
      PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62132.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        7⤵
        Executes dropped EXE
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        9⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6718.exe
        9⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-197.exe
        9⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        9⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50423.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34298.exe
        8⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53841.exe
        8⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7970.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47555.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4711.exe
        6⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58515.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        9⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        8⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44513.exe
        8⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14602.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28945.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22089.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        8⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63849.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        7⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43719.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
        6⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7573.exe
        7⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34010.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30733.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        7⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57060.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45635.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30251.exe
        6⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        5⤵
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        6⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        7⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64042.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44275.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-78.exe
        5⤵
        
        PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21676.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57633.exe
        6⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34769.exe
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        9⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        9⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        8⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50214.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13438.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11457.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        7⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28369.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21898.exe
        5⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44253.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        7⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
        5⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
        6⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55755.exe
        7⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        6⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43222.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10601.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-362.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        5⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37704.exe
        6⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
        7⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        6⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        5⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        5⤵
        
        PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6188.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        5⤵
        
        PID:14548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
      4⤵
      PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
      4⤵
      PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40145.exe
        6⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1663.exe
        8⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62328.exe
        9⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23776.exe
        9⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        8⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20976.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19511.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
        7⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23444.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20129.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49163.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23707.exe
        5⤵
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28920.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15534.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51620.exe
        5⤵
        
        PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
      4⤵
      PID:15236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33596.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3051.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        6⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19093.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        5⤵
        
        PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43200.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        6⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6673.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44851.exe
      4⤵
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51692.exe
      4⤵
      PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15158.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
      4⤵
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        6⤵
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29414.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
        5⤵
        
        PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35961.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15530.exe
    3⤵
    PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        5⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29139.exe
        6⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        5⤵
        
        PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52463.exe
      4⤵
      PID:15000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59293.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43864.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
      4⤵
      PID:15312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22210.exe
    3⤵
    PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
    3⤵
    PID:12476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2066.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2066.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50404.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        9⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14698.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5979.exe
        9⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        9⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        9⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24503.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        8⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29331.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14778.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29206.exe
        7⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43409.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        9⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        9⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11539.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20827.exe
        6⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        6⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3243.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63120.exe
        9⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9198.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17962.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37120.exe
        7⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31990.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31498.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        6⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33892.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31269.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46381.exe
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46711.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14649.exe
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10395.exe
        6⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39112.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33146.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        6⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63780.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        5⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42352.exe
        5⤵
        
        PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63288.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
        6⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8238.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        6⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48089.exe
        6⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16613.exe
        5⤵
        
        PID:14784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24208.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18604.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18192.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        7⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22202.exe
        6⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26815.exe
        5⤵
        
        PID:15140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24857.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12965.exe
        5⤵
        
        PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9358.exe
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22988.exe
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
      4⤵
      PID:1224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30154.exe
        5⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61496.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        6⤵
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45481.exe
        6⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        5⤵
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10278.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55576.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
        6⤵
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29834.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59379.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
        5⤵
        
        PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53824.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44637.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25830.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        5⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
      4⤵
      PID:7080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44177.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26691.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
        6⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25539.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
        6⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25258.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11739.exe
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61840.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15381.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17667.exe
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55874.exe
        5⤵
        
        PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
      4⤵
      PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44944.exe
        5⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9465.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2874.exe
      4⤵
      PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3865.exe
      4⤵
      PID:9692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56480.exe
    3⤵
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58505.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19448.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14279.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        6⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45402.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5283.exe
      4⤵
      PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64075.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28865.exe
    3⤵
    PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45960.exe
      4⤵
      PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55248.exe
        5⤵
        
        PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      4⤵
      PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60922.exe
    3⤵
    PID:9072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43974.exe
    3⤵
    PID:12728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
    3⤵
    PID:8196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1395.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28225.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        8⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13725.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13953.exe
        7⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34573.exe
        7⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61042.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        6⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 212
        7⤵
        Program crash
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4441.exe
        6⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28638.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        7⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31803.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46825.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27933.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
        5⤵
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64165.exe
        8⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34806.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39921.exe
        8⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        7⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60466.exe
        6⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63144.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9463.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48623.exe
        7⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56449.exe
        6⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-661.exe
        5⤵
        
        PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34461.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24694.exe
        7⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49271.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47972.exe
        6⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44713.exe
        5⤵
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17207.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60672.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65254.exe
        5⤵
        
        PID:15080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53775.exe
      4⤵
      PID:12712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46299.exe
      4⤵
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34577.exe
        5⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1310.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        5⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        5⤵
        
        PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21648.exe
        5⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35802.exe
        5⤵
        
        PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
      4⤵
      PID:13996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40996.exe
      4⤵
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21116.exe
        5⤵
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        6⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        7⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24101.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        6⤵
        
        PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59276.exe
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22391.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61241.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50709.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
      4⤵
      PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12691.exe
      4⤵
      PID:12760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        5⤵
        
        PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
      4⤵
      PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6826.exe
      4⤵
      PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44546.exe
      4⤵
      PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
    3⤵
    PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17158.exe
    3⤵
    PID:10840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
    3⤵
    PID:452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18026.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18026.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        5⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42107.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29642.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45415.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17578.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29336.exe
        6⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33672.exe
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30942.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49817.exe
        6⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-750.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24311.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
        6⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33619.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        5⤵
        
        PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63950.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23517.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        5⤵
        
        PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
      4⤵
      PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4223.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27649.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11279.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45667.exe
        7⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38386.exe
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64575.exe
        5⤵
        
        PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        5⤵
        
        PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      4⤵
      PID:13956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13734.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
      4⤵
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65001.exe
        5⤵
        
        PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20585.exe
      4⤵
      PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20059.exe
    3⤵
    PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14914.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
    3⤵
    PID:11936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
    3⤵
    PID:14492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8336.exe
    3⤵
    PID:2664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14955.exe
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12267.exe
        5⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8835.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2270.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60973.exe
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
        5⤵
        
        PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64926.exe
      4⤵
      PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29967.exe
      4⤵
      PID:12804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4888.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40955.exe
        5⤵
        
        PID:15872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53132.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
    3⤵
    PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
      4⤵
      PID:16324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-262.exe
    3⤵
    PID:9812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    3⤵
    PID:14248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27705.exe
    3⤵
    PID:2068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
    3⤵
    PID:3540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51928.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22758.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38351.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18606.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
      4⤵
      PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
      4⤵
      PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
      4⤵
      PID:7252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
    3⤵
    PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
      4⤵
      PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
      4⤵
      PID:7836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12187.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
    3⤵
    PID:7800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
  2⤵
  PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51933.exe
    3⤵
    PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48239.exe
      4⤵
      PID:1436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33235.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
    3⤵
    PID:10148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14130.exe
  2⤵
  PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55696.exe
    3⤵
    PID:12536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
    3⤵
    PID:8260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
  2⤵
  PID:11684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
  2⤵
  PID:15156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5992 -ip 5992
1⤵
PID:6460

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 2748 -ip 2748
1⤵
PID:16380

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11187.exe

Filesize
468KB

MD5
f20d6aaa65a7bb17395eaf03fe77596e

SHA1
f094ee0ac7ab347f7a784d9f835867cb05c993ee

SHA256
69be7388cf8fc8d020bcf39dd5afea6a3ce074f266d8a8e9a1aecff9e5dc06b6

SHA512
9061b0b43a1575751022863ef617cdb842a28a3c5cac7a44f44b62859a91ea7823d0973438aac760d916ba1330022f9154d8a3d46e2aea3485364c36e7f15d53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12531.exe

Filesize
468KB

MD5
3eaae7f8ea5725c98dc20901455be1a8

SHA1
236059b7cd63a35ce9d31ce985a9780552e274be

SHA256
df892fee86acfe35021f1003a8f7a62ed5ea85f5731f849fdba742a99c4b2135

SHA512
81730c66734caa81f9bb99c7c32ab1d6bc1ac149a34fd92c1f2b1a8dfceca59a26f380a439d492cf604511711d5bd0e223e7c7a848e45d1f19f5f1b5e4f8b37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14102.exe

Filesize
468KB

MD5
74cff1f0e4313456a1b4bedcb3034ee2

SHA1
957d06ada4952c9f3c8fd1a9255b2c52fdb9d8ef

SHA256
806edc31abfd6fdea2d4426266f4f2e0c6babd44bcc8b0d56299adcb09f2e9fd

SHA512
ca14f8892d10101fb4f4cf12232c4d95bbb6ded2a255e6abef190877d1f5b32404943134783c9b1c12ff12c030c02f01d86934de1902d1d16468e3fdac092f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17087.exe

Filesize
468KB

MD5
c89f962c1e652e836e066247a0d38354

SHA1
73ac63e4dab85cc2a07fa622ebf439954eaee3d2

SHA256
2bf42ad4b48702ff169e66b8c36df3e0d75c243c271e489ebd45be26d3a4ebbf

SHA512
515dceaf4343ff55c366dfe8a376a8f5b502b08ade13d89d699143ba22ca1208b14afa1429bb62d37746f3ed56313b125a892bab754a236eea6c0a90a813efcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18026.exe

Filesize
468KB

MD5
e7809724de721b679fe8ee074caec668

SHA1
28a3ce87298389b1a98ebcc4070eea49d677c59c

SHA256
ade8ef8945e691b1cae55189000592494bab4401d2eee16ef01f726f51a84d20

SHA512
0bc5d1bf9925456ef9a54e6fda1b461fa81d7aa9edb8b83f92cb4f3da7a045dbf892aa3f2cdf54006baf799e81ed68131ff7a5e0befbae8072ee379d67dd5165

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe

Filesize
468KB

MD5
15c1a0cc2767a80b49b41469490bd76a

SHA1
2a81fe404be05434f3675092728c2c65fbdef650

SHA256
3650b3b6f65bacc5a08b55917c47407e48d1ca93864fe4ac2b14d6aa4fd5e709

SHA512
6d3bc123e7d7c42db8060c3f61d17e20004c435820f276f28822c094880cb022328ca318e28482893cfd0be2dee0049d97b77d0b467a93138e68523783084483

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe

Filesize
468KB

MD5
4bf62c451f28d36f967a9ff7720a7919

SHA1
5c86d0848c8fd793805cbbb55068b1d0155e5d25

SHA256
a5aed9533a5179fc3273b17dbf1842d51c2b238d1c35c576703b356ec8e03df9

SHA512
b784c98666747d46f15ee91dc34abce351b0f6ef4f6a52c06888363733dbdcde13c6025b275bef7857e636eeb0c9edfc49043959abcdc646a72493108061b063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2066.exe

Filesize
468KB

MD5
20fa09b0cba00365054569c391d33c5d

SHA1
8d690e562fd564c9f41524fa38f1813a2dd34a7a

SHA256
95fbb9ed9d52330f3cf17ea4539a2dc9a44076d98cfd5f57bb4b6e188b4f8f00

SHA512
236de3805c4814ff45dd24323889ca786e5d643a523726f2d839ad66b9140ff93a7d56313849865b4f48790509f1ac178f892283fe7c58fbdde6c5b0e2d067d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe

Filesize
468KB

MD5
95cd5f53675dfdc64e494c947074bf1f

SHA1
8aa6ebeacf338b9c004ed9ab39bc448646f37cb3

SHA256
3a23996215520e63209ae2a8178565829756ebb5c25e71ff4074c7a35ae0143b

SHA512
f16192b34cae4138019eaf470f279a22e5b722966ea62824675776496098639ed0018b2d0aa20f7ef52acdd9f762b79110a0d12c5d67e5662812b5a434996ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24436.exe

Filesize
468KB

MD5
26f808a93b0fde16c956210016ed0fce

SHA1
9d1c081bf50f49b78206a9ee9fea3b127f63d0fb

SHA256
a9660492487a8a4f2e5a5ceb8547fd16cedf136b1e80966b52a4d4ceb187fd88

SHA512
f860daa03c4849007c0ad77ae7b6ee60e3ba62628b5ef19ca1027b0e0fb2c78e1f8c9b372e98481aa5637845507d459aedfeeb12889035ee8c162d404f7f3150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe

Filesize
468KB

MD5
32ba1768506e24a81514236299cbaf04

SHA1
e339cbe236fef7162074a3572809c5ca038ec30c

SHA256
4b300dbf1737e5e702b7899f44685aaf3e4655e62a280afaae757738efd5b768

SHA512
608d5f316fcc01652b517d8981d478faea8ca1fba94facdee19a8175c5b68560f10da4761ab638bff2311aff3d97cbcae128f543a459dc178e6563d5316bc791

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe

Filesize
468KB

MD5
f275eefeec5a4df6ce7efe0d183bbf73

SHA1
a55cc30f84d09420dc2d74aa29cd1bb3d2694bba

SHA256
a337fcfd06f9ccd5a35faaf8f779eae38e25b6764f47615f37189c9ec3838226

SHA512
a3e22ba8715b48c2de23fc0e332233756f46f13eea21418b73c65d5f3d784424b362c613d039035a7046019090721178c5d0b84857cc552d0026ec3769d8ded2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26668.exe

Filesize
468KB

MD5
6677e40a256c5f48d41258843501a678

SHA1
976e7a8e785279549ad74bbfab633da6fb65f721

SHA256
3ee2397d79a98aad19cd63c2b068aa74abb0e27f2eb8430ab345a98a578155bd

SHA512
a4e0ab9739856e4a0ba730c1cb710f51f3ed3d2fdecc423dd341ebfd9ef0407f395cd731b7c540f8830e92c3e08e17636b17425785a39056f0329ff4ebe373e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe

Filesize
468KB

MD5
98101f07739384f1472b4473b58d2573

SHA1
2250da56c0eae29ca0751d908b382cc11b0548a6

SHA256
f90cd95c208858b376b0fc2c3ac01ef779153ccec9e85dfcda6fe5519c7d9156

SHA512
45f8dd33222775f53dfe4a6587a93914cfd7485432be8cb98161b814e56550ebe91920a2b54625056e93d63dfa7ade869dad95f8169006b66bcb503fc51a1c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe

Filesize
468KB

MD5
48fffa18ceb8cee1f9a0f5d4edbdefe9

SHA1
43bca86ebaf8504b0188580c47f567cf7d1e0c28

SHA256
28a253fd0d4c7d23e5dd8d998f137929643f20ad506cd6d61505f5d87a8c96bc

SHA512
adc812b7dcfed1a8862ab916ecff1610f7d73e4b7156fc2f82a8dc03e14825759b4466e3074d1e9003d689d709c85a5e9e402d54fd5fbc2b51c98ddb8a8366a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30297.exe

Filesize
468KB

MD5
c72a88eb3b700c26b2c779155488b4ac

SHA1
be94cd2bd7364ca9b06b8946f36436aace551a5d

SHA256
f680ebd701f2e716bb65ffc92a25a7358616424de713eaae2b889cc0ee2e102a

SHA512
60ee4405787fc58362c6ae8a390d6fa1776a316754035dfbdbb7f015c7234a7885e2de91bb9e5b09cc973f03647f10103acfaafb7e5fb3f81d453fd2ca83d20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3038.exe

Filesize
468KB

MD5
a30f3f654623a225a814e2c576a62e3c

SHA1
2522a5634509363e2732f61b0af209ebdb0b9fe1

SHA256
e32705226480befe0a5e735d7cacf36edfad9afef7647c3a25006f3e7d017f09

SHA512
960d5b0f31c241488e1121a368a61bcd04aa4a483ee504ed17a1139c34a733a2401ca80c952a7d351a4a47900c6ea276916456bec780ddf369deb3d934803f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32345.exe

Filesize
468KB

MD5
bc2a77c680b1c1179667cb8b3a1e2ef7

SHA1
95c077f6cd116be4d2d9a3dbd58f74bc5c172411

SHA256
ab2dbfa864c18f11a611ddc93b8c2ac0065034d74cfefd4b2d44fb0aefa13df6

SHA512
ddf769eac855c95019e47971f5c2fcdb9c9c0b15a554ecc8bd34970b24e2fdc5ff881d5e716af23933b2c8cfe9b84bbe90a06be45d4f96258200ceaa36b9d2f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38105.exe

Filesize
468KB

MD5
f8da9d6059ec6553cd99bbf8ed05e6d7

SHA1
ddae3cf53c465c51819e271a9a32d906a8dd9cc9

SHA256
8e77bf7d051268a2342afa935b5720d1659126178b2bd79bd9a22b2d58890c95

SHA512
72c681fcfffec0ec4c85ed4195fb9efe6b121fc03a3cd9af5f1aaf1f1c15ad80a60eedee9443e017d96a2f1ffcf95d8f7968981005a22eb4cc7a28dd9da7f380

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe

Filesize
468KB

MD5
f48591289b2785f5166b4a30dc9f82c1

SHA1
7e46aa32fa9c1e19ac0107f2f1628470dfd06802

SHA256
cd895e2d26031456bd718482d42999bce6a84ac7e10ef484d8a83fd105e5f53f

SHA512
5c6f17201523af7f4c7ecf0befe4deef8cd06bb12b412e560304c56854f03ee4ac87ca013f8f48724aa6a3d7af694dee9a209041409b27b0aa88ab10e9ddb3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42931.exe

Filesize
468KB

MD5
40b9309b4feed8baf5885940cfa4f9c1

SHA1
964156d01139c11363a2df9082a9416b240439db

SHA256
12d6d951c3fd171ffec381108ae37374c85ee7c612b3ecb2c51aefdd9fcceb47

SHA512
1dbae35a1589340ca020eda9e2e704db99611dc0f26b6411f3e45e59a2982ea23c05b6a521910f3ea47427c17ddb7965221205172fe8467aa8747c971f33023c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44634.exe

Filesize
468KB

MD5
debb1b332797a631671cfe3a52f4a874

SHA1
483d39048ad236e1b34223ebd20e81dc6784adcc

SHA256
9e575fe780596f966ebc48490de26133b49ba6bacc252423727577615f9ef583

SHA512
3001f52a099a100bf344e5361b6b146b782ecbf75973c8ebb9d4247c6786e0f1bbc310c230ea93aee7870ef25ba28086b125c72b8643b03ea7daa56bab871fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe

Filesize
468KB

MD5
fb0fa24663b83344af3e1c9d10ea69ca

SHA1
a8c75230fbfcdb0405ca744a030ebda07aef6260

SHA256
87a19cd34c3e1d9ebcc5852f5ef9758f212b0ba46c1cc002ba89513d2d91cd1a

SHA512
09fa1807f25c18eae372ae33e907a86be3257cd56647114f3b93ddd34200edf6eefb43f062bc60bc19ba9782100e169fc0700eb3ddc6348960d3445d92586fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe

Filesize
468KB

MD5
248f77c3adf6b6da5ac28b6671c9ea8c

SHA1
376b26622d4b528afdbd656ae826a4ed66565ae2

SHA256
ae6b435a3335a9282a0e42a6cfadc13dba32cf8cd66b854fcdfdb52c28fc65fe

SHA512
64295d3f05656c937f1af78408a0274f06a9ba1111b667fdc1e10a734fb8664b332564219521248726df9c9c11809e34b693768e2fea45b042174964fbbd51b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54840.exe

Filesize
468KB

MD5
f9ddec0ca745d623994c8781150a1c8a

SHA1
e9363dc3693a725b69d0401c1a2a34c67d309869

SHA256
1f8fc1027186349334d3cf9a0e2a7ad817f81f4d495735a992c70abd2c77bc9f

SHA512
ee0656518a6b7fd0d8b16968dde7b18674e5f7a5c96f930524b5205bbe331b7a53c3e433ac71b01fd025c57743c285b5a4353bbb449ea796f22b2df8a4990f73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58608.exe

Filesize
468KB

MD5
28d67d81684357dda0098acc26f61f28

SHA1
fff5896d263452499a67e5601ddbc493117102a3

SHA256
5cd6dbbbc640fb6a638caf1bfcba40dcbf5963af3082ecc5143c128fd37fd302

SHA512
91e9007c61533613e1c2a2d14602402a1c52e1bc2fa4fa0fd681a56a388c3a31c69ccc420b0c7a7e3a6b2149f74e680040cf1a3de3a6f490a21796325aff94d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe

Filesize
468KB

MD5
40f0511fed4ab9ba7364bb176c3c819a

SHA1
fe032cf6e6102b5074f6fc70dedd49460c367536

SHA256
375afe2d1d567d5a011c80ccc5a34d2be22baa87bb6c951c1e551f57337132ab

SHA512
825df44684fa4ceb162147b2d1cd5bb5087c250b2836f35eb019f604dfb1f7d856557b06c7cef7a5706c4b40219c5a73370805bfada50573f6854e84d4ebb75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe

Filesize
468KB

MD5
9ad61fbfe2c92236a803056e718812a8

SHA1
c69e59109a49f4eb566ac4d55f82423b7ef53036

SHA256
e86f7c56847886db40cb647d28b47a7cc59b4ea148d2c66d44ed4046ce2cbea5

SHA512
ae795efcbfc5497667385693768deb315ef9c22767eaa5a4c9876e0ca9d541ed48851d6e60b223a425024088a2f852fc4f2a81f4542c6be3298bff031472b4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62609.exe

Filesize
468KB

MD5
95d04513d89d4b071e17f046790c200a

SHA1
a55f0a5873c4637474b586a840c4f7bc1761981d

SHA256
feecf627172e135dec460a73391e1b6f31cbf36b91004e1460b7a989f4c65a1a

SHA512
6395369391f7ec64f5db9af561e1aa418179c44b62bce6b3a001cecdbc637997b95e1a78daacf5f452924b094ae625ad255c58b2da387d3b5b095fa9cde0ca5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8047.exe

Filesize
468KB

MD5
10bc5600cf44b13f76d38ab604bef041

SHA1
eafe6fed526a4461a42c1d84ed407b20feb78f0c

SHA256
2c68a3ce8ac49f9ba286b3e48abd42022108e278379325d1a84a59e929ea1f06

SHA512
cb135dd65cb24d7f56a1542ce336a719d713cdacebc6569de4fd74f8dd6dd808afc4a1914735fd93cec47c8eb9fd7d88ca9b86b51adbaaf014a406432cdebfea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe

Filesize
468KB

MD5
c2265e43eab4ae34844407730f1d599e

SHA1
25e332b1c0b2f73162417f127f6ac7ce96c56b20

SHA256
2f766f356d11a0f781e22d14522ddd58bf21d06e207ed4478f39a5f70f2b8cc5

SHA512
6cc65c8f558af95c0fafc2076b0004535318d11b38527e486eff11b82b9e7abcf5fd9483def3df4ea2d370560fb21d82acff424aec3465289065fdcea7576f2b

Download Submit
memory/8-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/772-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1168-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1904-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-65-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2292-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3348-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3452-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5096-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15188-2674-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads