771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe
Size

468KB
MD5

ae7803a56280606a7ca5a87bb9a19670
SHA1

737e00e8578db8760cd42b1bfa37f987a698c28f
SHA256

771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0
SHA512

f5e0100b035123d62174247289c097c26b06f4ab47503e49e55af00f921f52d800ded69806ff6381f2775a18c9d7dbfe4a7d463572fcbcee8e488d68c51aaf68
SSDEEP

3072:sr69ogKxj28UFbYpP43yqfL/bpX1EPpaOmHxklyV0NY0MO/tKQl8:srAotXUFKPGyqfkBqZ0NBf/tK

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
320	Unicorn-57638.exe
4984	Unicorn-56652.exe
980	Unicorn-18312.exe
3276	Unicorn-56434.exe
4600	Unicorn-56434.exe
2484	Unicorn-56334.exe
4576	Unicorn-42598.exe
3496	Unicorn-53850.exe
4492	Unicorn-49766.exe
760	Unicorn-2703.exe
2500	Unicorn-2703.exe
4948	Unicorn-48375.exe
3120	Unicorn-48375.exe
3484	Unicorn-33165.exe
1988	Unicorn-27299.exe
4720	Unicorn-56948.exe
4864	Unicorn-51281.exe
1480	Unicorn-26606.exe
2148	Unicorn-5423.exe
4920	Unicorn-34774.exe
3620	Unicorn-2464.exe
4928	Unicorn-63917.exe
1620	Unicorn-17980.exe
1264	Unicorn-12115.exe
2712	Unicorn-12115.exe
3504	Unicorn-48972.exe
3824	Unicorn-16854.exe
2208	Unicorn-17068.exe
4216	Unicorn-44265.exe
3544	Unicorn-64706.exe
1548	Unicorn-64798.exe
2252	Unicorn-16060.exe
1916	Unicorn-65069.exe
1412	Unicorn-42510.exe
4660	Unicorn-42510.exe
5112	Unicorn-62468.exe
4228	Unicorn-46040.exe
3768	Unicorn-15313.exe
4248	Unicorn-63937.exe
992	Unicorn-65453.exe
2840	Unicorn-55168.exe
868	Unicorn-18966.exe
3624	Unicorn-16274.exe
2860	Unicorn-22038.exe
3360	Unicorn-26388.exe
3640	Unicorn-36694.exe
2444	Unicorn-57690.exe
2160	Unicorn-37824.exe
728	Unicorn-14611.exe
3136	Unicorn-20476.exe
3176	Unicorn-59066.exe
2300	Unicorn-2459.exe
1972	Unicorn-14611.exe
3252	Unicorn-37632.exe
540	Unicorn-57498.exe
2128	Unicorn-24634.exe
2080	Unicorn-31410.exe
1552	Unicorn-45146.exe
3936	Unicorn-3948.exe
4380	Unicorn-43108.exe
3956	Unicorn-47860.exe
3012	Unicorn-48152.exe
224	Unicorn-19372.exe
4420	Unicorn-17980.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
12232	6420	WerFault.exe	290
9608	6404	WerFault.exe	251

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33936.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46040.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8172	dwm.exe
Token: SeChangeNotifyPrivilege	8172	dwm.exe
Token: 33	8172	dwm.exe
Token: SeIncBasePriorityPrivilege	8172	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe
320	Unicorn-57638.exe
4984	Unicorn-56652.exe
980	Unicorn-18312.exe
4600	Unicorn-56434.exe
3276	Unicorn-56434.exe
4576	Unicorn-42598.exe
2484	Unicorn-56334.exe
3496	Unicorn-53850.exe
3484	Unicorn-33165.exe
1988	Unicorn-27299.exe
4948	Unicorn-48375.exe
760	Unicorn-2703.exe
4492	Unicorn-49766.exe
3120	Unicorn-48375.exe
2500	Unicorn-2703.exe
4720	Unicorn-56948.exe
4864	Unicorn-51281.exe
1480	Unicorn-26606.exe
2148	Unicorn-5423.exe
4920	Unicorn-34774.exe
3504	Unicorn-48972.exe
1264	Unicorn-12115.exe
2712	Unicorn-12115.exe
1620	Unicorn-17980.exe
3620	Unicorn-2464.exe
3824	Unicorn-16854.exe
4216	Unicorn-44265.exe
2208	Unicorn-17068.exe
3544	Unicorn-64706.exe
1548	Unicorn-64798.exe
2252	Unicorn-16060.exe
4228	Unicorn-46040.exe
4660	Unicorn-42510.exe
3768	Unicorn-15313.exe
1916	Unicorn-65069.exe
5112	Unicorn-62468.exe
1412	Unicorn-42510.exe
4248	Unicorn-63937.exe
992	Unicorn-65453.exe
2840	Unicorn-55168.exe
868	Unicorn-18966.exe
2860	Unicorn-22038.exe
3624	Unicorn-16274.exe
3360	Unicorn-26388.exe
3640	Unicorn-36694.exe
2160	Unicorn-37824.exe
2444	Unicorn-57690.exe
1972	Unicorn-14611.exe
728	Unicorn-14611.exe
3136	Unicorn-20476.exe
3176	Unicorn-59066.exe
2300	Unicorn-2459.exe
3252	Unicorn-37632.exe
540	Unicorn-57498.exe
2128	Unicorn-24634.exe
3936	Unicorn-3948.exe
2080	Unicorn-31410.exe
1552	Unicorn-45146.exe
3956	Unicorn-47860.exe
4380	Unicorn-43108.exe
3012	Unicorn-48152.exe
1840	Unicorn-50098.exe
4244	Unicorn-19372.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 320	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	86
PID 4236 wrote to memory of 320	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	86
PID 4236 wrote to memory of 320	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	86
PID 320 wrote to memory of 4984	320	Unicorn-57638.exe	87
PID 320 wrote to memory of 4984	320	Unicorn-57638.exe	87
PID 320 wrote to memory of 4984	320	Unicorn-57638.exe	87
PID 4236 wrote to memory of 980	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	88
PID 4236 wrote to memory of 980	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	88
PID 4236 wrote to memory of 980	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	88
PID 980 wrote to memory of 3276	980	Unicorn-18312.exe	90
PID 980 wrote to memory of 3276	980	Unicorn-18312.exe	90
PID 980 wrote to memory of 3276	980	Unicorn-18312.exe	90
PID 4984 wrote to memory of 4600	4984	Unicorn-56652.exe	89
PID 4984 wrote to memory of 4600	4984	Unicorn-56652.exe	89
PID 4984 wrote to memory of 4600	4984	Unicorn-56652.exe	89
PID 4236 wrote to memory of 2484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	91
PID 4236 wrote to memory of 2484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	91
PID 4236 wrote to memory of 2484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	91
PID 320 wrote to memory of 4576	320	Unicorn-57638.exe	92
PID 320 wrote to memory of 4576	320	Unicorn-57638.exe	92
PID 320 wrote to memory of 4576	320	Unicorn-57638.exe	92
PID 4600 wrote to memory of 3496	4600	Unicorn-56434.exe	93
PID 4600 wrote to memory of 3496	4600	Unicorn-56434.exe	93
PID 4600 wrote to memory of 3496	4600	Unicorn-56434.exe	93
PID 3276 wrote to memory of 4492	3276	Unicorn-56434.exe	94
PID 3276 wrote to memory of 4492	3276	Unicorn-56434.exe	94
PID 3276 wrote to memory of 4492	3276	Unicorn-56434.exe	94
PID 2484 wrote to memory of 760	2484	Unicorn-56334.exe	95
PID 2484 wrote to memory of 760	2484	Unicorn-56334.exe	95
PID 2484 wrote to memory of 760	2484	Unicorn-56334.exe	95
PID 4576 wrote to memory of 2500	4576	Unicorn-42598.exe	96
PID 4576 wrote to memory of 2500	4576	Unicorn-42598.exe	96
PID 4576 wrote to memory of 2500	4576	Unicorn-42598.exe	96
PID 980 wrote to memory of 4948	980	Unicorn-18312.exe	97
PID 980 wrote to memory of 4948	980	Unicorn-18312.exe	97
PID 980 wrote to memory of 4948	980	Unicorn-18312.exe	97
PID 4984 wrote to memory of 3120	4984	Unicorn-56652.exe	98
PID 4984 wrote to memory of 3120	4984	Unicorn-56652.exe	98
PID 4984 wrote to memory of 3120	4984	Unicorn-56652.exe	98
PID 4236 wrote to memory of 3484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	99
PID 4236 wrote to memory of 3484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	99
PID 4236 wrote to memory of 3484	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	99
PID 320 wrote to memory of 1988	320	Unicorn-57638.exe	100
PID 320 wrote to memory of 1988	320	Unicorn-57638.exe	100
PID 320 wrote to memory of 1988	320	Unicorn-57638.exe	100
PID 3496 wrote to memory of 4720	3496	Unicorn-53850.exe	101
PID 3496 wrote to memory of 4720	3496	Unicorn-53850.exe	101
PID 3496 wrote to memory of 4720	3496	Unicorn-53850.exe	101
PID 4600 wrote to memory of 4864	4600	Unicorn-56434.exe	102
PID 4600 wrote to memory of 4864	4600	Unicorn-56434.exe	102
PID 4600 wrote to memory of 4864	4600	Unicorn-56434.exe	102
PID 3484 wrote to memory of 1480	3484	Unicorn-33165.exe	103
PID 3484 wrote to memory of 1480	3484	Unicorn-33165.exe	103
PID 3484 wrote to memory of 1480	3484	Unicorn-33165.exe	103
PID 4236 wrote to memory of 2148	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	104
PID 4236 wrote to memory of 2148	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	104
PID 4236 wrote to memory of 2148	4236	771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe	104
PID 3120 wrote to memory of 4920	3120	Unicorn-48375.exe	105
PID 3120 wrote to memory of 4920	3120	Unicorn-48375.exe	105
PID 3120 wrote to memory of 4920	3120	Unicorn-48375.exe	105
PID 3276 wrote to memory of 3620	3276	Unicorn-56434.exe	106
PID 3276 wrote to memory of 3620	3276	Unicorn-56434.exe	106
PID 3276 wrote to memory of 3620	3276	Unicorn-56434.exe	106
PID 2484 wrote to memory of 4928	2484	Unicorn-56334.exe	107

C:\Users\Admin\AppData\Local\Temp\771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe
"C:\Users\Admin\AppData\Local\Temp\771ed6ae06f2ef88c6792179d13d8f704cb7f4c873b0e7a6c22739f9d8e9e3b0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2459.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4343.exe
        9⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        10⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60952.exe
        11⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        11⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39991.exe
        10⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        10⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24472.exe
        9⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        10⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        9⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49823.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        9⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
        9⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        9⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61471.exe
        9⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        9⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46643.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
        8⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49792.exe
        9⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        10⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        10⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        9⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        9⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18250.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23298.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44513.exe
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5180.exe
        8⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31785.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        7⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        8⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4971.exe
        9⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18570.exe
        8⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        8⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        7⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45146.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63227.exe
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18594.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
        8⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-916.exe
        8⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
        7⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30529.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34397.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        7⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        7⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43384.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        7⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        6⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57498.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        10⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        10⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        9⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        9⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42613.exe
        9⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10298.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31131.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13066.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46839.exe
        8⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34829.exe
        9⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32856.exe
        9⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22743.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        8⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3526.exe
        8⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
        8⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        7⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16404.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3523.exe
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32190.exe
        9⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15705.exe
        9⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-72.exe
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25537.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12682.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26508.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17008.exe
        7⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47029.exe
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2237.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10681.exe
        6⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24634.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42640.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63265.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        8⤵
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9905.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        7⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37190.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        6⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56424.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6483.exe
        7⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        6⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60758.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3497.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        7⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        6⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27616.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        9⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        9⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59091.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        8⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54984.exe
        8⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        7⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11603.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27099.exe
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19820.exe
        6⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7179.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35332.exe
        7⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28006.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36492.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24715.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41208.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        7⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15062.exe
        6⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48643.exe
        6⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21313.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        5⤵
        
        PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe
        6⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        7⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18930.exe
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16547.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        7⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
        7⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        7⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        6⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41114.exe
        5⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62070.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        7⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        6⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        6⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        5⤵
        
        PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64872.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51577.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        7⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10416.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14335.exe
        6⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29787.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30223.exe
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47872.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11071.exe
        6⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55905.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        5⤵
        
        PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        5⤵
        
        PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7069.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      4⤵
      PID:8536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48152.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23472.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        8⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17725.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12420.exe
        7⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        7⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
        6⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60459.exe
        7⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25310.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
        5⤵
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60534.exe
        6⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40205.exe
        7⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48723.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
        6⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5207.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26300.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        8⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58652.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61359.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
        7⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19016.exe
        7⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7586.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6341.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35959.exe
        7⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50368.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        6⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13511.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10902.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        5⤵
        
        PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        5⤵
        
        PID:1760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40451.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26445.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
        5⤵
        
        PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        5⤵
        
        PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
      4⤵
      PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48359.exe
      4⤵
      PID:14348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7695.exe
        6⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
        8⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
        7⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63568.exe
        8⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61590.exe
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        6⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exe
        5⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
        6⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17811.exe
        7⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        6⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        6⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5478.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37976.exe
        6⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16909.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        7⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41082.exe
        6⤵
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        6⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1577.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21159.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61141.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        5⤵
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      4⤵
      PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
      4⤵
      PID:14184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54566.exe
        5⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6647.exe
        6⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
        7⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53471.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2257.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        5⤵
        
        PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
      4⤵
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37374.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37670.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19757.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        5⤵
        
        PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        5⤵
        
        PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
      4⤵
      PID:14104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
      4⤵
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55315.exe
        5⤵
        
        PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
      4⤵
      PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36170.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27595.exe
        5⤵
        
        PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30016.exe
      4⤵
      PID:13032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
    3⤵
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55799.exe
      4⤵
      PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36302.exe
      4⤵
      PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46773.exe
    3⤵
    PID:9668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
    3⤵
    PID:8808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55298.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        8⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        9⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        9⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35047.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
        8⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21622.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16950.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36675.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63583.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34638.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43508.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52841.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19095.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4698.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
        6⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25677.exe
        5⤵
        
        PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51239.exe
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27747.exe
        5⤵
        
        PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36694.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44452.exe
        6⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60612.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43766.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52052.exe
        7⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22744.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        7⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28892.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        5⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28220.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8828.exe
        7⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        6⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27216.exe
        5⤵
        
        PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22086.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        7⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27815.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21758.exe
        5⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1053.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        6⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7969.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
      4⤵
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        5⤵
        
        PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43600.exe
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38608.exe
      4⤵
      PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        5⤵
        Executes dropped EXE
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49530.exe
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
        7⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26932.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36905.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        6⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32283.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        5⤵
        
        PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
      4⤵
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64265.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        6⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9750.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
        5⤵
        
        PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42345.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51656.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16135.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
      4⤵
      Executes dropped EXE
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        5⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6306.exe
        6⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48758.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25243.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        5⤵
        
        PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54396.exe
      4⤵
      PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30693.exe
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31921.exe
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
      4⤵
      PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28848.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29476.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
        5⤵
        
        PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27312.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16281.exe
        5⤵
        
        PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
      4⤵
      PID:12528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61142.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62812.exe
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64827.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12348.exe
      4⤵
      PID:8592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
    3⤵
    PID:7504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32316.exe
    3⤵
    PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60892.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60630.exe
        7⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35882.exe
        6⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30664.exe
        5⤵
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1565.exe
      4⤵
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12677.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        6⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16626.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25177.exe
        5⤵
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
      4⤵
      PID:12536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63917.exe
    3⤵
    - Executes dropped EXE
    PID:4928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53907.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40472.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24214.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62482.exe
        6⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27460.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52145.exe
        5⤵
        
        PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35494.exe
      4⤵
      PID:6420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 632
        5⤵
        Program crash
        
        PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38531.exe
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      4⤵
      PID:14140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
    3⤵
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16762.exe
      4⤵
      PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        5⤵
        
        PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
      4⤵
      PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      4⤵
      PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8983.exe
    3⤵
    PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54748.exe
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
      4⤵
      PID:2832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35120.exe
    3⤵
    PID:10004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
    3⤵
    PID:12324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
    3⤵
    PID:6284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46040.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-897.exe
        5⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58204.exe
        6⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40619.exe
        7⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21233.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
        5⤵
        
        PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24586.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37592.exe
        5⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1864.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17646.exe
        6⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        6⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23179.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18415.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35916.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47828.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15035.exe
        5⤵
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3724.exe
      4⤵
      PID:12836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19096.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        6⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54103.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19472.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18773.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9509.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31755.exe
        5⤵
        
        PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19672.exe
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19048.exe
      4⤵
      PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10117.exe
    3⤵
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44582.exe
      4⤵
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58326.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3990.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23677.exe
      4⤵
      PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10658.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 636
      4⤵
      Program crash
      PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
    3⤵
    PID:12384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-721.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27599.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30773.exe
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
      4⤵
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61919.exe
    3⤵
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31179.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-290.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
      4⤵
      PID:988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      4⤵
      PID:12560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45931.exe
    3⤵
    PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
    3⤵
    PID:11312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63937.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27094.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2210.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21848.exe
        5⤵
        
        PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35186.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41026.exe
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
      4⤵
      PID:12024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35022.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1389.exe
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34232.exe
    3⤵
    PID:13828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60748.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31780.exe
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      4⤵
      PID:14392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58043.exe
    3⤵
    PID:8664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
    3⤵
    PID:12464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12679.exe
  2⤵
  PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
    3⤵
    PID:11996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12244.exe
    3⤵
    PID:5916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
  2⤵
  PID:9928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6404 -ip 6404
1⤵
PID:6640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6420 -ip 6420
1⤵
PID:12088

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12115.exe

Filesize
468KB

MD5
8c79af37f91de87b4a27a4c90b28e4ca

SHA1
f3859a2ec6f811689b29d62de8676371ff572d6e

SHA256
b6b03698cae7284ccea8d35e59f804f8a5cd2a80eca32dd7fdb4438459f423d9

SHA512
fbfc8caf3d398a682209d8260dfee12407bff8f81da0aabc06a17c6fd9f0eafa5eb629ec2c938be6b92bbf4854821db9818edf48f90aec433012bdcb1b02f0b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe

Filesize
468KB

MD5
a4906858aeb8fe17321eda8382564535

SHA1
319d90e7efb2fcf422d3e127dd9e1d26054dadf4

SHA256
24070254dc9fe7c203fb0a5ed62281e3949460f1be2e9b36405a0f82bfa1c465

SHA512
c254b8aa1a620b64a3a9ae6d683dff53f9663492856aa8ef0625395536291d0b05e3f14204fb39dd77b28b74e47304d54ae2993489bec6a18cdf0762d43279fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16854.exe

Filesize
468KB

MD5
02ec34254ef15ffc4ce358253a78ef57

SHA1
8dae68a29c33316e74e576006e200ab28ea96088

SHA256
0fe06633b97493f48e4b5ed9a3966ef72f7366f09f602c7114d501e3ede0fc96

SHA512
0b44f5fda1f47a40351840629f01ed36ea6e55bdff8b085ea810c26ac00ee56fb76a38672afb7a28199e795df56bfbc151329fddf8b8b8871caaf28bc3610db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe

Filesize
468KB

MD5
eeccec45608659b82474349342dbffe2

SHA1
721527f50959cb0c5c5770185faba1045554816b

SHA256
31e9501af020888b63ec6b340b884594d8445d208478e3962344a32d90106a2c

SHA512
88af62637ce45efbc306731edf9e347ad54e43a7ac86771443bb33e37ddb66460fcfefe1a2799751bc2c37f03f233b869340c312ded9ff38b53b5e1cf23c87bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe

Filesize
468KB

MD5
4fb90d719d9a0b63fd4b5deb0a1d8c30

SHA1
9c250c7c6ccae16f00ece8c7b4e4625066f9995e

SHA256
376707ad688a74ebdf91f966602d0a4456e69b37cb568779b1327d1c68c91002

SHA512
e81dd19e6be79ec3be1f617f86f70b07af53bda7ac7e2948479943842e03b771f3bcdd51fbf93e1479be15f8fbbd2e7165d431733322329a1ed45a5971e3c64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18312.exe

Filesize
468KB

MD5
0bc1c180c0108904a6749df4610cc20e

SHA1
9e40a887a6674a3b87540e21b7150e4225548419

SHA256
995a1848315573492b6849bfd95817b732b6103580ead3d2a6b20aad12bd103a

SHA512
f83f78e3b48a6f397503eb0a7108656fa337dfa3d5b4bb9977ece56437322743c06fab2f517f33d4b48280aa112ace2058ee1fba7f1d54c91b98b9df33c26b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe

Filesize
468KB

MD5
101fcaea9554fbbbde32464337f16435

SHA1
8c136235469c4590b068b003aa09ca53fcf5824e

SHA256
6290382da14b0ea4333bedaef1ce7fa2e33036db1549382818be9c3bd91b4937

SHA512
4e83b8a94b3889c3f06011d2f4d12b560102b05736fb80b5af79ba6bb0bb511d0726d1246a6e5f1c65b588e2ad090e850b2b4266a191a495ae3e4329192309b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2464.exe

Filesize
468KB

MD5
b6f61d8484e40a0e60e6b5160ff65b4f

SHA1
ef2e349b3e09697de626b0e9f649344c7a633cc7

SHA256
81c56d5c6a09c00cceb330cde24c1c9fd06b4d0ccad92eb951ebd3f0f7fe0086

SHA512
391f441030c7b5d554c6e5b921aaa56b2ca0bf0c989fa63ca8618ac492f7aad6f092fd3f2a89ea59306b838fa538784f22d5e084355dbb72313ca5eb21c87372

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26606.exe

Filesize
468KB

MD5
2c80196b6b1281c3d07b01f851de71df

SHA1
4d4f2b4bbd3e7eddfd18b63f10712d4b2b6d8416

SHA256
41a84991709d0f75f635687c63cda1f13fede1be04372159e466fee823509f81

SHA512
02f8a363da9c955e151b0a372d136018c3bc3e81a481dc603bbf363795e96b3325d6dce50cb8a00833c07ddc9528bc6bdf50d9bee631a15c40032e36e7b4e371

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe

Filesize
468KB

MD5
93b5b34a05febad129599b960744db67

SHA1
4f4cf65da759b7daa248175ae2de656d062dd4a9

SHA256
df74fe31f88383e9e0d992b593fd866d40aa6be8f37ac9cd73a7a216903a1f5c

SHA512
de0a36a8f9f71d36ad7bad57ebd20d67dfd99ed85d40ef7e9637fe504ea7927b6e6bb224e4f7be1d7af0bd80d0673b043bbe3bbb6ab84d72f544eec888b4875c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27299.exe

Filesize
468KB

MD5
4127bc1407d1c42ccd6b24554ce77382

SHA1
b8ccbcaca5909d05f5b4630281f0c83a6a2ab8fa

SHA256
27e8e90e244296694bf1924ce399812cf2fa8b44feea0d5a957c0a63bf843df9

SHA512
116a585abb6baec1469b7f2f5fb119c819854aebc9c7fcb9c71a4872577695a12a1291a106e50f919f609f69c498e0e31e9b8d8cb2cdd28c4854758a25418468

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33165.exe

Filesize
468KB

MD5
0e2e1dbcee92eaef64b3eb11b624cc4f

SHA1
5ba11839cd3e8b569b9548f1b8f13d6d629bc586

SHA256
def962b3dc381b01be6cdd51558e4300a49c0b31ec7634e7996b31e5aafd9f97

SHA512
c0ecdeacd23e0a5cc454a43006906f1d77d389cbb970cebe94df5a25b1e18b642579525542bb24cf7f609c8643bdf472b5147b24ce1231c231b58bf54867303a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe

Filesize
468KB

MD5
245a2f02b88b95771fa6bb576a8e3d81

SHA1
a0d475d47c23eeca699acc4500b8fcd26841199b

SHA256
a62d92021be58ff15097a6dc9cd252d9d93302c15e6348803ddc4aa9b3325609

SHA512
27926dffd6459e3f816e1db6a69e854bacb2bae728d5fd8715f3997b6f57ebd1b324deeeba78aecb77457c945812a0a18187cae5638e92da7c90036b85c52f49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36284.exe

Filesize
468KB

MD5
55863d6b52b885673f8b191a1090c908

SHA1
060dea2d52d39448f3e1e444a85071e6fd07040b

SHA256
8a4e39c21b8ae268d127fb2c528be9c44cd2a8b7a1cb92efbfdc06f7ac7947d8

SHA512
e4fd562430fae01012c8988c8549b796d60d5ffe571d9245cb00b3ffee30f46aacebcf7074dc6659cba964f60ceb148481eb59697d0cc64322c5ad977f1407e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe

Filesize
468KB

MD5
90e9b42052ce9341cafebe1dda0a8c5f

SHA1
75616046b6e3bc34d6de6364083b449ad801f3f4

SHA256
291886e028c3cdbb92684b8ce6becfd0fa64a2307b8dea8d1132430c5e7aa56f

SHA512
141322808b15a21313d20b8db336c3683952065a49052b8900e4297acca968a2412e58d461cbabf7ec3c9cb144a00a4f0321a63276587b42a801bfddbf407159

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42510.exe

Filesize
468KB

MD5
c04fa3a2247093bc0909417ebb3abcbf

SHA1
3e0bf5d8e40cc0cae6cc2f3a42afcac519896267

SHA256
c41106b0648ce340b7aba7f5be538ddd184270a1acbc6d603de5e425fa4fb765

SHA512
0a45ab4b586024e9b3c7370207db6fed3ab31a600f85be52e933e0e28d7f4c09eafb850b2c818c6da779065581d09ee3c3aa7411a56eb06bef42f195f286c218

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe

Filesize
468KB

MD5
31e4ff65ff98b11902018647acee22fd

SHA1
c534e426b857481f45781c2de9c57b81d7beae62

SHA256
710080a9aa6a40bad9eb6d850987272bd6b1d6cb6da168da1be261d62588f38a

SHA512
437247cfec17559878fa5906a0073cd49589a69334354b66731e0bc4ac27776364ea38fc7ac0e573c77f6ae65af05d7733db13802c9effcb120e64c671e3a37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe

Filesize
468KB

MD5
6453349f2b4597a91bf5516cc4113eea

SHA1
731942fa6a782c1ab4af8c6a09b450ce9b494d19

SHA256
b1aa1450f8c9cc8a5f81f24a9f82b2ebdf86e3648d096115a1e1ec109666ccac

SHA512
19b2de05f5ff1dc903c0b9427717fa6c067283dc825e10bab2932644c256656a1e66de0d7af6c9c6880f471eefe85c33efd1c37a0a3236d74da451e885958f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe

Filesize
468KB

MD5
45c8a3769d2a3c185209ca0b35af0420

SHA1
f695e4b416ff359d692ec7ee5213d48dc2f4f4ce

SHA256
4f874ce7f0579f077f021d6a2082efe42014cf81fd2104c0da50ae84d63824cf

SHA512
2329eef6228d89d972ec166e7a9545b0fd7b448346154c3dccae6f7a3007cfc7a53aa2c64b9db75add8e40299b51e7a81b8a548629ff7660cbe19d7ae52f320e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe

Filesize
468KB

MD5
7f6d11ae997e5e090de6bcd147558b76

SHA1
17b8525d7790fbd8d3c98194a1adc70d4c808c06

SHA256
8fc0ddfa4f29cf01f23c89af4fb80f99d4e394da4e6d31ea6734f67b711ae607

SHA512
b57ad4ff8400bf43d09028d57abea66f543e36ef8cb56e525bc0c5b0a12952632aaa09cae435ac36e2f56ad728dca0126cc0ca0ac494ee49c5977299bd8a9f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49766.exe

Filesize
468KB

MD5
928fcf6344d6c13126811f4e3ea818df

SHA1
f22fc78f025bbf24647806faa921ea91c69cab50

SHA256
1475a40c16a26246db0421cf72db4a6df5a1c3e1de253f62e582cc678ccf27e4

SHA512
0662a67bffa0d4092d8668d68eba1a7cd943207571c6fc4d61ce8ebaf89a4efd022b5197c407cc4594a43433e6a96801db46698e9178f18d2b59c424c30e7766

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe

Filesize
468KB

MD5
3ffaff16084d7d28853368b7903019e7

SHA1
c27e8b398ba4615a55965a7a55269967e1d50a28

SHA256
76e268b8cf6b7c54aa86efaf8a4346c32cb513e367b2dd931eb43b4f7a53fabc

SHA512
bca29ebc26bfc68a68621d5524757f9e5fb6b9d204bf78658777bf70588666d5ae7e9627dd6090839335ca52faa753ce4f6974722c463410a95d6d652b4bc807

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe

Filesize
468KB

MD5
a8732a11f4029842e8c9232586ab988a

SHA1
a1ce5a1013ea574b0ad9b8532a468271cbf1b3b6

SHA256
40c5ceaaadc75611a9fcfcba8ca74f38e7afa2fd7e8c185810e85552334b1611

SHA512
2b8fc61a507b229a87958e818692f569d1bcfef4c5ac04801b984d92eaf605040536eb6a9757e927e0e852006bd3f890e8bce990b28287a138cfb8478209d9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe

Filesize
468KB

MD5
1fb436fe0a730817efa0caa27ff6a83f

SHA1
8842424b70c8dda91f5fda1024ca490978ecbfe8

SHA256
396e4b93e6b4e501a87be0d51481dd68994070b302626580177ff070d59be847

SHA512
8f32b5102e7207a820defe30fed079efb87da6d3096e90dcd540ef9a714d4d57d2d4bff273fc9efe25e9f91640e2b8e12837e5d34617d24799883c404908012b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe

Filesize
468KB

MD5
938439cec3e384f41ebeb1414830b80e

SHA1
772978eb5e1694f4a9ad8020f26716303c50c98c

SHA256
3b2a04a5e12c473673c9d81e39eacb1921d94e5f71e515f0de4efefda747c43b

SHA512
8c7c0b934b88fc642d164b5010a65bb362406d482428bf62fb6713e577e7780233a55f74289d61a7dd6c496c06c9f95b3af84ef0aa727bb823a4e79b81bebe2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56434.exe

Filesize
468KB

MD5
4c30f9770626295a2160407a51ad058c

SHA1
a9ad8d9cf5696bcbb2539049d2e893e67e41b28f

SHA256
658d37cbc5ac7501390c3b102a07e65df125c1096e16e5be3531cbfbea01bedb

SHA512
2a2c1a275da232e7fe909f05e458cd708595d4252ea94dfdeba786aedc908ae4aa89a05737563d68c9a8efb26339471b606af85bfee2ebd36357e0d3a64259c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe

Filesize
468KB

MD5
2deac1d29c00e61536c40601cad5364f

SHA1
875cf76e6b306f6a83faf6b501f05264fe2a6345

SHA256
8f2cc9f81dd544d8f0403fba3ca9edf43e3194a3d8562aa035c68e694629f97e

SHA512
3b5ae770120f76a10cfec4675c5e4fa29ce5a096175add773cc6aa110ac23cd30c77654eb2a2cb4aaf6f40f8a23d5da99e62ecb3af0e95af3acbd437b7936a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56948.exe

Filesize
468KB

MD5
bc5c0cda9aa44156160da891caf0a990

SHA1
a3211a7fe31e73b4f145f9f9a796af166b013084

SHA256
51b80221f3b24ed01e5e1370ee3c670dfb361fbf12d3eeb2bb7f7d1ce87b89a2

SHA512
ee4f5ecfd391c0f10fce0cfec30d01a34785df1b1cdbb9414163c862349ea071767bff48c35f9fbcf0fba363a1a38fa7c0ddd6770f3acefb7da77500e72da177

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe

Filesize
468KB

MD5
9afcaecf9a0de30b45bdee3ebe85bdec

SHA1
fa048991aa259152793685e9b0cfb3adefd19bcb

SHA256
ca873d4d8d105074e1b986919e52f1b611c5c15864df0d443412b0f190d16e0c

SHA512
43dc29fd7240b24f3fb57b91b42d4ad3e9f5072933d8499148ff017c642684aa7b2f1b18b4b89f05086036aea234c83b75c991c15bf692c26f17fb12b005c548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63917.exe

Filesize
468KB

MD5
975aebcce552dd4800cb5b1b562a2e90

SHA1
dee89971f7d1bfd8a72022192c942b33cbaf6acf

SHA256
a8b277926d7d303b02760b7a4b2055b611eca1dadaf47e74684afc9da0b89f4a

SHA512
3d98d55e6e5fabb154fb62252e6546a6bfcd40b4acd37b43371c4cb110a21d0d8e536af5aec4240772de61fb32d8362a78f9e0fb0e9bb063f630858a21d60f07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe

Filesize
468KB

MD5
5f54ad8ffa3835d63d227b0175a99d95

SHA1
df5eb6360e3c3ff43271af6960a181c945f9933c

SHA256
7b828f5abc847adffd4a87cc31b05fc501b40625ad2ce4d64599067d2fe7c09a

SHA512
59e9f9ecaba70a7698596fd9bf8eeb3326bb8e4cf03d9dc9a5c478ed6147475bdfc3711f15e95d7ebc2f64115f68c925bf9204c632e8901d67ff502202ea637f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe

Filesize
468KB

MD5
7d3a8eccc6710891025e21c8746d789d

SHA1
04263da89e32b098ea55ad90a6b1f15045d4ca2b

SHA256
6c0045fec171110524f83088e8f6a07804bef2e15c19ac597cc913dbe2a0196e

SHA512
d9cfe6448b67a09f899a225fc29b33aada50bb0ad4e07c5b1ed2714c4818120e5df758d5fb31b3196d0f70baba917158af64a67cfd46953393e5fd770b12b7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65069.exe

Filesize
468KB

MD5
6e27c5a9249c8a45ec9e1dcc8a93393c

SHA1
fdfecebc2144beeb7bb4b64525c85f6a0cbca4c7

SHA256
9b70511c31e606634d2198253b026681883b75ec17f8202c11ba5d0ff721f4e6

SHA512
97f93a82765dc7cf817855f7b0ce7ff1c265d900dca64869311c629c83e8b122be7e9bffee22dacc070e57ccf0b2ee3ba57e3ded3c5429275655b4689369f502

Download Submit
memory/224-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/264-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/540-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/728-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/868-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/980-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1216-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1480-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1820-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2444-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3360-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-579-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3544-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4228-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-586-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-598-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-599-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-602-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-606-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-607-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-608-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-609-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads