f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe
Size

468KB
MD5

f9087e9da28ade646d45ed567b482ef0
SHA1

3059544b3f1b0bea5a48e40fb09365056400d12f
SHA256

f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c
SHA512

9f757c1eae6af6aad6a8e8da9d88d6fb0313de3657e9a84cda3d1840d03f57984e20edb0468f6ae7a4425441f3ae54f3b5acd08a67b3fd915d9be446e321a894
SSDEEP

3072:OI1IoggRjk8UkbY9Pz3y2fCbNCBjYIplP7HxpT/J/if+XzPNailEi:OI2ojJUk+PDy2f40ff/iGjPNaw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2044	Unicorn-3452.exe
2776	Unicorn-41444.exe
4152	Unicorn-41998.exe
4736	Unicorn-45056.exe
3508	Unicorn-49887.exe
556	Unicorn-4215.exe
1452	Unicorn-3238.exe
1132	Unicorn-43961.exe
3576	Unicorn-35278.exe
4808	Unicorn-34532.exe
1788	Unicorn-53098.exe
4876	Unicorn-58963.exe
840	Unicorn-39362.exe
816	Unicorn-4682.exe
3532	Unicorn-29976.exe
3608	Unicorn-63203.exe
2892	Unicorn-56518.exe
4436	Unicorn-55165.exe
2424	Unicorn-37760.exe
4300	Unicorn-20469.exe
3444	Unicorn-29400.exe
2628	Unicorn-23269.exe
4064	Unicorn-62819.exe
3668	Unicorn-16882.exe
348	Unicorn-20721.exe
436	Unicorn-59716.exe
1816	Unicorn-12414.exe
3460	Unicorn-26149.exe
2604	Unicorn-61615.exe
1068	Unicorn-15944.exe
2468	Unicorn-7754.exe
1712	Unicorn-19452.exe
116	Unicorn-35788.exe
464	Unicorn-38201.exe
2396	Unicorn-18335.exe
4372	Unicorn-5336.exe
3352	Unicorn-9975.exe
2596	Unicorn-23710.exe
3440	Unicorn-28886.exe
1660	Unicorn-37552.exe
4672	Unicorn-39870.exe
4272	Unicorn-48808.exe
1008	Unicorn-25373.exe
2228	Unicorn-7967.exe
3864	Unicorn-7967.exe
2664	Unicorn-9866.exe
4328	Unicorn-23601.exe
4400	Unicorn-59124.exe
1492	Unicorn-38668.exe
2088	Unicorn-21682.exe
1468	Unicorn-26909.exe
2420	Unicorn-45714.exe
1960	Unicorn-54759.exe
3168	Unicorn-60624.exe
3332	Unicorn-23618.exe
3180	Unicorn-41023.exe
3948	Unicorn-26764.exe
2120	Unicorn-51460.exe
3308	Unicorn-6343.exe
1868	Unicorn-52612.exe
4972	Unicorn-60780.exe
4060	Unicorn-28793.exe
2016	Unicorn-57059.exe
216	Unicorn-27724.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3604	3608	WerFault.exe	113
14532	13448	WerFault.exe	655
15100	13264	WerFault.exe	611
15104	12836	WerFault.exe	628

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3982.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5190.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4452	dwm.exe
Token: SeChangeNotifyPrivilege	4452	dwm.exe
Token: 33	4452	dwm.exe
Token: SeIncBasePriorityPrivilege	4452	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe
2044	Unicorn-3452.exe
2776	Unicorn-41444.exe
4152	Unicorn-41998.exe
4736	Unicorn-45056.exe
3508	Unicorn-49887.exe
1452	Unicorn-3238.exe
556	Unicorn-4215.exe
1132	Unicorn-43961.exe
3576	Unicorn-35278.exe
4876	Unicorn-58963.exe
840	Unicorn-39362.exe
4808	Unicorn-34532.exe
1788	Unicorn-53098.exe
816	Unicorn-4682.exe
3532	Unicorn-29976.exe
3608	Unicorn-63203.exe
2892	Unicorn-56518.exe
4436	Unicorn-55165.exe
2424	Unicorn-37760.exe
3668	Unicorn-16882.exe
3444	Unicorn-29400.exe
2628	Unicorn-23269.exe
4064	Unicorn-62819.exe
4300	Unicorn-20469.exe
348	Unicorn-20721.exe
436	Unicorn-59716.exe
3460	Unicorn-26149.exe
1816	Unicorn-12414.exe
2604	Unicorn-61615.exe
1068	Unicorn-15944.exe
2468	Unicorn-7754.exe
116	Unicorn-35788.exe
1712	Unicorn-19452.exe
464	Unicorn-38201.exe
2396	Unicorn-18335.exe
4372	Unicorn-5336.exe
1660	Unicorn-37552.exe
3352	Unicorn-9975.exe
3440	Unicorn-28886.exe
2596	Unicorn-23710.exe
4272	Unicorn-48808.exe
1008	Unicorn-25373.exe
4672	Unicorn-39870.exe
3864	Unicorn-7967.exe
4400	Unicorn-59124.exe
2664	Unicorn-9866.exe
4328	Unicorn-23601.exe
2228	Unicorn-7967.exe
1492	Unicorn-38668.exe
2088	Unicorn-21682.exe
1468	Unicorn-26909.exe
2420	Unicorn-45714.exe
1960	Unicorn-54759.exe
3168	Unicorn-60624.exe
3332	Unicorn-23618.exe
3180	Unicorn-41023.exe
2120	Unicorn-51460.exe
3308	Unicorn-6343.exe
3948	Unicorn-26764.exe
1868	Unicorn-52612.exe
4972	Unicorn-60780.exe
216	Unicorn-27724.exe
4316	Unicorn-28601.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2044	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	89
PID 1484 wrote to memory of 2044	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	89
PID 1484 wrote to memory of 2044	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	89
PID 2044 wrote to memory of 2776	2044	Unicorn-3452.exe	94
PID 2044 wrote to memory of 2776	2044	Unicorn-3452.exe	94
PID 2044 wrote to memory of 2776	2044	Unicorn-3452.exe	94
PID 1484 wrote to memory of 4152	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	95
PID 1484 wrote to memory of 4152	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	95
PID 1484 wrote to memory of 4152	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	95
PID 2776 wrote to memory of 4736	2776	Unicorn-41444.exe	98
PID 2776 wrote to memory of 4736	2776	Unicorn-41444.exe	98
PID 2776 wrote to memory of 4736	2776	Unicorn-41444.exe	98
PID 2044 wrote to memory of 3508	2044	Unicorn-3452.exe	99
PID 2044 wrote to memory of 3508	2044	Unicorn-3452.exe	99
PID 2044 wrote to memory of 3508	2044	Unicorn-3452.exe	99
PID 4152 wrote to memory of 556	4152	Unicorn-41998.exe	100
PID 4152 wrote to memory of 556	4152	Unicorn-41998.exe	100
PID 4152 wrote to memory of 556	4152	Unicorn-41998.exe	100
PID 1484 wrote to memory of 1452	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	101
PID 1484 wrote to memory of 1452	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	101
PID 1484 wrote to memory of 1452	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	101
PID 4736 wrote to memory of 1132	4736	Unicorn-45056.exe	105
PID 4736 wrote to memory of 1132	4736	Unicorn-45056.exe	105
PID 4736 wrote to memory of 1132	4736	Unicorn-45056.exe	105
PID 2776 wrote to memory of 3576	2776	Unicorn-41444.exe	106
PID 2776 wrote to memory of 3576	2776	Unicorn-41444.exe	106
PID 2776 wrote to memory of 3576	2776	Unicorn-41444.exe	106
PID 3508 wrote to memory of 4808	3508	Unicorn-49887.exe	107
PID 3508 wrote to memory of 4808	3508	Unicorn-49887.exe	107
PID 3508 wrote to memory of 4808	3508	Unicorn-49887.exe	107
PID 1484 wrote to memory of 4876	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	108
PID 1484 wrote to memory of 4876	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	108
PID 1484 wrote to memory of 4876	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	108
PID 2044 wrote to memory of 1788	2044	Unicorn-3452.exe	110
PID 2044 wrote to memory of 1788	2044	Unicorn-3452.exe	110
PID 2044 wrote to memory of 1788	2044	Unicorn-3452.exe	110
PID 4152 wrote to memory of 840	4152	Unicorn-41998.exe	109
PID 4152 wrote to memory of 840	4152	Unicorn-41998.exe	109
PID 4152 wrote to memory of 840	4152	Unicorn-41998.exe	109
PID 556 wrote to memory of 816	556	Unicorn-4215.exe	111
PID 556 wrote to memory of 816	556	Unicorn-4215.exe	111
PID 556 wrote to memory of 816	556	Unicorn-4215.exe	111
PID 1132 wrote to memory of 3532	1132	Unicorn-43961.exe	112
PID 1132 wrote to memory of 3532	1132	Unicorn-43961.exe	112
PID 1132 wrote to memory of 3532	1132	Unicorn-43961.exe	112
PID 4736 wrote to memory of 3608	4736	Unicorn-45056.exe	113
PID 4736 wrote to memory of 3608	4736	Unicorn-45056.exe	113
PID 4736 wrote to memory of 3608	4736	Unicorn-45056.exe	113
PID 2776 wrote to memory of 2892	2776	Unicorn-41444.exe	114
PID 2776 wrote to memory of 2892	2776	Unicorn-41444.exe	114
PID 2776 wrote to memory of 2892	2776	Unicorn-41444.exe	114
PID 4876 wrote to memory of 4436	4876	Unicorn-58963.exe	115
PID 4876 wrote to memory of 4436	4876	Unicorn-58963.exe	115
PID 4876 wrote to memory of 4436	4876	Unicorn-58963.exe	115
PID 840 wrote to memory of 2424	840	Unicorn-39362.exe	116
PID 840 wrote to memory of 2424	840	Unicorn-39362.exe	116
PID 840 wrote to memory of 2424	840	Unicorn-39362.exe	116
PID 1484 wrote to memory of 4300	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	117
PID 1484 wrote to memory of 4300	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	117
PID 1484 wrote to memory of 4300	1484	f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe	117
PID 4808 wrote to memory of 3444	4808	Unicorn-34532.exe	118
PID 4808 wrote to memory of 3444	4808	Unicorn-34532.exe	118
PID 4808 wrote to memory of 3444	4808	Unicorn-34532.exe	118
PID 4152 wrote to memory of 2628	4152	Unicorn-41998.exe	119

C:\Users\Admin\AppData\Local\Temp\f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe
"C:\Users\Admin\AppData\Local\Temp\f40f6e9d59ab7cfdf366c1a87ee8c9349a46bf34bdee4a849871ce032fd3ab8c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
        9⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        10⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        11⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26765.exe
        11⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        10⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        10⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        9⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        10⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        10⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        9⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        10⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        10⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        9⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        9⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39919.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23618.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10936.exe
        10⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        10⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        10⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        9⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        9⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11381.exe
        9⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37044.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47611.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41684.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45003.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8507.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35420.exe
        9⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        9⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44438.exe
        8⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28378.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31075.exe
        7⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54282.exe
        8⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
        8⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        9⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        9⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        7⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8574.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3206.exe
        7⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32825.exe
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        7⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17458.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34392.exe
        6⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3608
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 640
        6⤵
        Program crash
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28601.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14075.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        9⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60311.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62560.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30075.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2938.exe
        7⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20819.exe
        7⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
        5⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        7⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        6⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61606.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        6⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44619.exe
        7⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63919.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        5⤵
        
        PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5627.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63404.exe
        9⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55086.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        7⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50121.exe
        6⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54759.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        6⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58860.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        7⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28818.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50411.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        6⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55227.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        7⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58382.exe
        5⤵
        
        PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44413.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48684.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28590.exe
        8⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        8⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32953.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36780.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56447.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23012.exe
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        8⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18873.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        7⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        6⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        7⤵
        
        PID:696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        6⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27893.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53536.exe
        6⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        7⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46468.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55575.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        5⤵
        
        PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28793.exe
        5⤵
        Executes dropped EXE
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        8⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54963.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23114.exe
        7⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        7⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        7⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40762.exe
        6⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19673.exe
        5⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        6⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        5⤵
        
        PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14620.exe
        6⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        7⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        7⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        6⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63623.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        5⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28822.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31547.exe
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25012.exe
      4⤵
      PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        5⤵
        
        PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
      4⤵
      PID:13392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
        7⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59960.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        9⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        10⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        10⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        9⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        9⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        9⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5937.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        7⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56857.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        9⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        8⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        8⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        7⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        7⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53031.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51047.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13110.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        6⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21160.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        6⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43889.exe
        5⤵
        
        PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        8⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22173.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41690.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        6⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30153.exe
        6⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9695.exe
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29150.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        6⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2954.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        7⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13546.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27847.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10207.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60339.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        5⤵
        
        PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        6⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49354.exe
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23078.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61434.exe
      4⤵
      PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55274.exe
      4⤵
      PID:9728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28928.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        7⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20836.exe
        7⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        6⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        6⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37688.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10783.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        6⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        5⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe
        6⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34553.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11178.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
        5⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31931.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50186.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3734.exe
      4⤵
      PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
      4⤵
      PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
      4⤵
      PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41180.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        8⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23795.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54084.exe
        8⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45895.exe
        7⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        6⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-746.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
        6⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47641.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40099.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47511.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      4⤵
      PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28886.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5575.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4771.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exe
        6⤵
        
        PID:13892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41262.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16810.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40930.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        5⤵
        
        PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        5⤵
        
        PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41163.exe
      4⤵
      PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
      4⤵
      PID:15184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27722.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13987.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9763.exe
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8510.exe
        5⤵
        
        PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      4⤵
      PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
      4⤵
      PID:15352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
    3⤵
    PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
      4⤵
      PID:14556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48270.exe
    3⤵
    PID:10404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19218.exe
        8⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
        7⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16064.exe
        7⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44849.exe
        6⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41023.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        8⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
        6⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31222.exe
        6⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13448 -s 436
        7⤵
        Program crash
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59559.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15716.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        7⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55979.exe
        6⤵
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58896.exe
        5⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        6⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12836 -s 472
        7⤵
        Program crash
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47189.exe
        5⤵
        
        PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62596.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55930.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        6⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14776.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        6⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26458.exe
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        5⤵
        
        PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
        7⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        6⤵
        
        PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24495.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63910.exe
        5⤵
        
        PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42203.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49348.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17896.exe
        6⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
      4⤵
      PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13434.exe
      4⤵
      PID:8836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        7⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        9⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10437.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
        7⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        6⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44771.exe
        6⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8543.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
        6⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        7⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36794.exe
        6⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6347.exe
        7⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        6⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49276.exe
        5⤵
        
        PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60780.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44256.exe
        9⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1957.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48247.exe
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        6⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49607.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25529.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        7⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        6⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        5⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        6⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15222.exe
        5⤵
        
        PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22553.exe
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        6⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34474.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
      4⤵
      PID:9956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7967.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22466.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32696.exe
        8⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5849.exe
        7⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10430.exe
        6⤵
        
        PID:15224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39434.exe
        7⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58336.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9222.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10090.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52543.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38823.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42527.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64828.exe
        5⤵
        
        PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
      4⤵
      PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        5⤵
        
        PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23583.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      4⤵
      PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
      4⤵
      PID:9876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
      4⤵
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9675.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        6⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56276.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2838.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9467.exe
        5⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        6⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        5⤵
        
        PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        5⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58175.exe
      4⤵
      PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
      4⤵
      PID:8644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20438.exe
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      4⤵
      PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
        5⤵
        
        PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44954.exe
      4⤵
      PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64576.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47380.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
    3⤵
    PID:10800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
    3⤵
    PID:7840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3238.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3238.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38668.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29369.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27584.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        7⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11790.exe
        6⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        5⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4823.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        6⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47620.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19001.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12830.exe
        6⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61823.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23457.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47878.exe
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46486.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23391.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
      4⤵
      PID:14380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21682.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61164.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        5⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28861.exe
        6⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25503.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19903.exe
        5⤵
        
        PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
      4⤵
      PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        5⤵
        
        PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26762.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34608.exe
      4⤵
      PID:14528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2841.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
      4⤵
      PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
    3⤵
    PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
      4⤵
      PID:13400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
      4⤵
      PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34524.exe
    3⤵
    PID:9228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
    3⤵
    PID:15260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47162.exe
    3⤵
    PID:15272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
    3⤵
    PID:14400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37982.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52633.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22783.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        6⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56238.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        6⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48279.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51158.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
      4⤵
      Executes dropped EXE
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26681.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        7⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        7⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51837.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3305.exe
        7⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
        6⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17251.exe
        5⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36450.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17202.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59430.exe
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        5⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59940.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23265.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39526.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3183.exe
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51133.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63816.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23942.exe
        7⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        7⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22346.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        6⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50671.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21305.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44491.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7245.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28980.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22926.exe
        6⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51847.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30682.exe
      4⤵
      PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40236.exe
        5⤵
        
        PID:12644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
      4⤵
      PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13041.exe
    3⤵
    PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36712.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6328.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16606.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61024.exe
      4⤵
      PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52808.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23500.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
        5⤵
        
        PID:13264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13264 -s 444
        6⤵
        Program crash
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
      4⤵
      PID:15088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38363.exe
    3⤵
    PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
      4⤵
      PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26242.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35926.exe
      4⤵
      PID:11696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44266.exe
    3⤵
    PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
    3⤵
    PID:8484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8263.exe
      4⤵
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5819.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60687.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
        6⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57739.exe
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36207.exe
        5⤵
        
        PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8803.exe
        5⤵
        
        PID:12944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
      4⤵
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6346.exe
      4⤵
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23993.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30341.exe
        5⤵
        
        PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25169.exe
      4⤵
      PID:13664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
      4⤵
      PID:6184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8106.exe
    3⤵
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21390.exe
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
      4⤵
      PID:6944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33256.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40028.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50685.exe
        6⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27910.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36662.exe
        5⤵
        
        PID:15152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
      4⤵
      PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59099.exe
      4⤵
      PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
      4⤵
      PID:564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
    3⤵
    PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48435.exe
      4⤵
      PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48267.exe
      4⤵
      PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
    3⤵
    PID:8196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
    3⤵
    PID:13428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8908.exe
  2⤵
  PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
    3⤵
    PID:12032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
    3⤵
    PID:5216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50958.exe
  2⤵
  PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
    3⤵
    PID:13188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
    3⤵
    PID:7088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3330.exe
  2⤵
  PID:12128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
  2⤵
  PID:9672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3608 -ip 3608
1⤵
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 8176 -ip 8176
1⤵
PID:14860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 12836 -ip 12836
1⤵
PID:7336

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12414.exe

Filesize
468KB

MD5
adf377f753eb3a341c828c00fb5bcdc3

SHA1
4c36e37f8ae5d859228570d346995fdcbbacf3a3

SHA256
f25033e4ca8c18378d9c51563aec40153994ac3a990ece8f7f77d40e807d2b0c

SHA512
d43e90211afe91b3c3eca8bfe03bd81eb8f3b4ef22edb2e2eebcf3ea6b352acfc16ac040ca6cd87d5ffeb6770b30a09c1bc48be917e7a392dc1862f13a2f7b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe

Filesize
468KB

MD5
ab305e0bfc26ddb6b95befa2505c9691

SHA1
19e49d30dc986ad7295d84e771b02a9852f5f230

SHA256
415cd5b9d0c07c378699a226c48384f51f87f44dcb36e0561b5755531e6d6f95

SHA512
c6fc7733f84481abc46f89ddfa6a9569f3d83193429984398b9b5b36c0e85bda95e3c3293a75780cba183879af1211fbf9afc222f16f8e9f4e7cea7133fa3538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe

Filesize
468KB

MD5
21d4c0716c4c0274f7bc2e4c3baccd4e

SHA1
9df0e5fcb588a664ecb9a9b1dc035f157c865817

SHA256
f49935d5977d3a586e3cd12291a412c19762df6aae128398c5cf98d392856f8c

SHA512
83fd598c2bed6ef4e319a6a1d238d33400f68d3bff4d8ebccc74144c90be8f91477e0f9207a9f6dbe2bd7f2b0176f604585e089c34c981d458060d8870e74013

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20469.exe

Filesize
468KB

MD5
703f0922a15c3dadec6446aa5017ea94

SHA1
79baddad164aa6b2079844b36ef244b245584b43

SHA256
2d0b3f2d82670fc12e7a38d7274040864e7e5c2c6513cf7ce93d65fda6bbe6cc

SHA512
7677facc9bdbc4a12864481919dcf1c6b74acdcc91ad378368d5fc8a9a22f25031ce49a662bb90078221e85e7d7e89968a7224d566bac7d302a25355a29d4049

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe

Filesize
468KB

MD5
aa71eaefbf115ca83099f6978ef9e672

SHA1
035be8e124d7af3096422fe46aa7812eb4f58c2d

SHA256
9912cd2e8097cb60efab66f39abd65b8811d7aea6680dce5dacdb9732e172af7

SHA512
e5451dca79823ce147658f165e8c89e2a75f2d064729986de9f2643df4cd45065e9e6ed0ac4927e491a358901b35c3eb0b6c0a90702d302d2a07b9fad9a1ec60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe

Filesize
468KB

MD5
5d3f28c6ede5ff40a1b4cd6547dc4425

SHA1
8196b02820e5fbadda0bc2792e4da29403fc23cc

SHA256
20ef08aa6e35aba19f1bce9b59014030d66c860811651cfd0036766eb58b5db6

SHA512
4e373f8fd8de6167aae20c7d7ce3fab63259a0893a2bf6947995d7e2892a23f0d01061349f6c8c6bf82653473dbb5a64377d32f327fda420aa94ceb1085aae1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe

Filesize
468KB

MD5
76b0aded7affe1570a1bb537741256c2

SHA1
6510de1e33e193dcc0c8909f885c91a552c8fb89

SHA256
4e6fb51012ed828683a95e2da3ff9be93fac2b9746e3e4181fc1763663673917

SHA512
7d7671bb031e69872137ad7b7b622b77ae114bbb978b841586a852274bce4c9dd1aeee3b8dc01b55948fedd2c9db4541da92f19de797d3e318a546919259ea89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe

Filesize
468KB

MD5
d6f19b42a0cfe2ac36cfa12da9a191f4

SHA1
e26c9c29ab96e21f87c9eec42d4c8796bbab1dda

SHA256
c9fb2142e229c538062798cf7ef0e95e3c8c9cea388726548f1ff606fa59275f

SHA512
ee2c14050aa07d9a26c21ad600b71336b531d9016334fc56c7bd4a08dd4a1e57427666d545c25283be6182eca90e70335e4b2961d59062863fcc708a302b0667

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29400.exe

Filesize
468KB

MD5
15b93ed7fbb3ee7cc5bdb5519f621f14

SHA1
c3b889f9fe5d2d033ebfb47791539740b62f7cc3

SHA256
561c6710d1d90867a9b4741c1df5986618754fe8e52cf84bd9fab26c44ec3b9e

SHA512
13ad694c4471846a4e31269d43f1c4ff1f462c94a49cc13bd4a862571e2118083a43a6c03432f2369a6f1276bb12e282dddf5dc59ccd150c56a21c1526d5b344

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29976.exe

Filesize
468KB

MD5
7aa76d119892576fa827fb8555f31db2

SHA1
de333438ae491ffe3f26f8e36688b498b279069e

SHA256
f7168f6c2c51e0169c569a9c0f8aa861678c4ac76f684dde769c9487de1093ae

SHA512
8deec67166abe2af1685b5a2da7f9209f1655ffa45b26ef62e32682736a639b5a260b1253e7d4d062852d6c90dcea3358dd6650240f2de2e2c71286bb9759002

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3238.exe

Filesize
468KB

MD5
80cd254acf902b9664e2efbb8fcfe209

SHA1
50beef406a3a8ada431808850e71089709871bfa

SHA256
d7e5a8b82a0dd48278e9771c042357c60f90ffeedcdcb1d5eda1329a4767f42b

SHA512
8f410f5f727565f758785c75a6315e894bbe6d18b20cfc3c4585bc3a59b385cfb29d1727c74ee57f4b9d40bebfffd57784fd5132d89cc0a1b9c76242caa4368c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe

Filesize
468KB

MD5
ee28e7513d576010d11f73debb259e6a

SHA1
3b7a2ed0fede589551fab052b01f0fcc33e2904c

SHA256
7521d6bc99d1c3eb8dbb4d03c215c0e360388f2097bfa27812e9b4319bd50c79

SHA512
c27520ea55b63debb4c4e8996923a2d0038011eab815acf2df739b45130838b24f779cc0892dfbd376755c6af8ba0013bc00c655413ef0282d5fba1651486dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34532.exe

Filesize
468KB

MD5
674225937ef9f7cd35f8c31cef58e033

SHA1
618437fd4af0a0f71b459667a3b59d64fd013e50

SHA256
66f0e376d94c417c4de28f752a12e75df18ce1ae38bb4fbd8fb1e98287208951

SHA512
6799790604ca6bfb81ce4a16fe8938b6c301560b9c930ecf686fd92b76fce2cb9be834876df13958dcd8a0c98b41532d81655762e4d7fb12d5a1eb421d8738a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe

Filesize
468KB

MD5
db7141819cfa75b9af1a0e5d1e800dc8

SHA1
3f09bcdefd9140bccd8e05d7f5cbff027067a246

SHA256
944b74f336c557a1672692680d5699af078ebc3b87089c007032164b9252c875

SHA512
c9803036c27d98fe7f1ac8e0a56d3f6854260a442e2910e647b0a8bcbc97cd5813ef34dcc4dd1b49572ca281708731c8ad6402aeb2ce7db257f5c76e8d8bc93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe

Filesize
468KB

MD5
dd8f28709371c261e3973a5ddde9fcf1

SHA1
02e95da72665976649471f3f28a3d934d14e41b6

SHA256
62dfcfbde70b87f4bfaf6ffe13e7eaeeee9ca75df4bf366e51fa76aa5ea66a56

SHA512
f6d6365ec32aee5acbc34fd1e7020e8f2000004de0166517ddf5c4325c2d201eeb55589e327050adc675ab7dab36ccf579145ef356a3f356a08b75ae53aac2e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe

Filesize
468KB

MD5
0c5d6e912a1dd0bb1c0aac0f60cf702e

SHA1
bcb16e54fb0b7a70cd6d9e5e3c54283cb2f9fbae

SHA256
3ef055e840544ed32175c4836ccf27bbee9d57e142e3f420c3e41f5b3fa9b208

SHA512
0da362634b271bc75114410c702d0821c148fd7c802a2874f85762b74ae688fb6a2baebb58071f55a01565c5be285902f3746f8cc6bddeed8ad8754ea2af0629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe

Filesize
468KB

MD5
97044a138d8e6996edb27f267422f727

SHA1
994a94e0692bec4bc41765e9581e71e81eca847a

SHA256
0d2ca5bacef287a1b57408956efdda0c8f26513c07f337fe972192a8dc51801a

SHA512
9ae0f1d97e156aacf1fc40ec28fe4e96fa62299e4d32f14bdc4a769781b4e6e8e6862da5069c0cb5d55201a4d5a0e4000998711c479cf8702fb1c45797dfb816

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe

Filesize
468KB

MD5
150aca84c8ef31b7034e7e81f6716f89

SHA1
c8a8a3ff8f32acf522f08245ab55cdc9ad34439c

SHA256
5c179fb36e491bc4eae05e985bac99d30e5052655e27fa508d3ec340e6e4c9a9

SHA512
b941a447458bed62ea6330abfc33c64fab9f7febe84581e89dae8571906094b901d745cea46bfcc5c927efaf25006d9352d40b08b8078511e73648c3c0d19837

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4215.exe

Filesize
468KB

MD5
57af8b769c80c0a2fe04cdfdb58d36ce

SHA1
c1b66fe450b7ea1c13290095fb82a4d33baa00ef

SHA256
47ae7d796ff1e91b4af1faf9933a8b984d49d95e701545ad096a2425507b9696

SHA512
e814def3df310b62e8f748054ee07150e2a4baa2bee60d93300457cd7c0f9ae4df098cbd28b213a9328a7b6328d852ce928ae23b4a9d5590574351f8c1d1bc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe

Filesize
468KB

MD5
714b4904e3a3092cd93f0685518ea1df

SHA1
f6dbe3a7e14b6b23f1ee69949c54b8aa04525adb

SHA256
84f17e6d64c4a605160feedf2d157f9c6d107533ac527de39a8c370181797bdb

SHA512
a602bb404ebb658beb033b8919bdd5436fe3e04d8d48eb81ccd213258ed87c71e47a5d175bceca7d603f1abb42d1b7df469c9c8ab249ed9e0f6f7c8a4725b6c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45056.exe

Filesize
468KB

MD5
6b264379d726c721e2ac5dfbb69c516d

SHA1
1f998217bc340c93c25affac572ac79315da4e05

SHA256
c105943b9a215bf8bda8b513caf1d813d5436148e1d138147d1958ceb76a6ee4

SHA512
03b0268bd63ceb77dba0a10f020158932a05b9e854836ca71e157ba1a72b8780a0810f16cd06679bdac51c4fddd59c86e522c72b25bd84f28cf9089b7abf229d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe

Filesize
468KB

MD5
0e888e7eeeccb2e5bc89e53aaa4c1dfe

SHA1
23d1ea5b95ca41b75aaa1c870776556313005c79

SHA256
64962c6c6b05b92388c475696b816a1998aa51deac34f9d30e4071a583c9a6da

SHA512
c0c8e2017656feb1ed874024123da9dd31d2cff036f40f338d1747cf38091dcc88982114463c92d0e4131f25305f24140a4cbefafd21bf4ae1114587a7bd134d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49887.exe

Filesize
468KB

MD5
e9a8c6bbe4a925947d911de4d438c472

SHA1
7a39412133ded4a53144975b0c743322c30a0f62

SHA256
b85e0b6d413f5eb5049cb6ba570ee80105cd754ebd185b4b52ef7168fe71e2b8

SHA512
781e57bca9b241fdfdbabbd70c804bd2f211d88c24a37745e6dc7444fe67b4a1e911c4880078935f674de291f705b6e02fccbfad0a7680a66f31abae55cfddb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53098.exe

Filesize
468KB

MD5
5fa1e7d595832db3dcda68cc906a7e92

SHA1
7939ef03d7f48d0bf402d2edcb05e8bf60823627

SHA256
ed48e008da803b1f8b64f676970fe32685a10365d9308311746b97eca9224589

SHA512
764e10d1db393397b693fd9a204f1589e2faa76272774149332a104cdc2bec051ab9dfc950fa05584738d029913f2b6a6b0dc85143ad02c7e89d6d0ddaf37810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55165.exe

Filesize
468KB

MD5
c4bf4bb19a51e8831c2dc2c8f6e44644

SHA1
a2b64e3b7b8b7b67834f3fd98f01e39d5748a018

SHA256
d12d6a7864f5c8e9c84cac45417a2ea46d3ed0d324f76a64ef66c96e7d059bd8

SHA512
621e31de25c562ffe3987ac3a7f8d99318ebcbb83aeabe0c5b19d4bdf5e8c4ef695320cbc5c55286ada5b65c5d9a5debc149573f79e96759557f8060d59816c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56518.exe

Filesize
468KB

MD5
258fd12a6a048ef56d7c4bceb9c05c9b

SHA1
03656bb99e48a513272c436cdf5509228a7c9465

SHA256
0a6d0f5a66c1d1ddf20371cc953903731a841ac8d7319e8c5881cb0ea98f1313

SHA512
6082c98b5bcfd7b04fbeddbb3d7ae651e01281b2b3f5406f19f6247153bd4e56ddfbe9a67bff998fba5ed89aab39f33ae3883d373e1d167474f60cc921f1923f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe

Filesize
468KB

MD5
6836715b9ba84011b04e203a80cc9acf

SHA1
3f538211afca6757f717c228ae1e459ffa3a7ffc

SHA256
f21ba26ebe5b6787f77622c93ac3df7e388dd29719574d9c17646bbfc31402e0

SHA512
a706846d35648288e00ba8a42a952bf9870e69922d328a4287ec804b00e9bb9950258be6e96633c92fe3a8e62f3cb4aca7d98134296290a5454924c217ce02db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59716.exe

Filesize
468KB

MD5
7709579b67ca2b56cbf7d47c6a5152e8

SHA1
e917adab67a0f960f8c3dc9cdb62f965d508a010

SHA256
2bc91aba42316b5b48eb2d715424d5c009bae41dbdc1733b615c4902132d6dce

SHA512
092dcadd1c586a9ecac7c5b1d2b2c1a8fad84bdc233a1bc4d56aa06faa9783558b2728f55d40d85f7dd42bba17b6dd1a5dbd081612ff1e9a78a5c488c751c845

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe

Filesize
468KB

MD5
ce8ae1420d893ce8bfd6f98c6e824bc9

SHA1
b0a60342fed98c9e6503b510a6cd7dee1789a149

SHA256
9df5ca134d1ccc30e41eee8f1ee0c2474eb3331b472629018f3faaa4ef6e6555

SHA512
0a13ed36ae405aba073f47a829c1a00e17840fd31ad1f61a994b79fc83ac27e724333a46040a4ceaba1be5312d0571c69634e17371d95f8ad485b65e35317c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62819.exe

Filesize
468KB

MD5
22f1a088fdd6a2d0d496e2db37e70aa7

SHA1
a43212fcf9b23213555671c53ffdb0b87acdba56

SHA256
f15522e03eec443055b116bef74d4c82ed9cc7f05a0358ea8f59c27eeaa66127

SHA512
9d7edd31ae0302950bfd50b7cb6452a374bb5764459859e720bd7126c2538779f7f82fb8289b4c94c13c604ad8a73947723f7c1855276ff55cf2d95e53b1ea6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63203.exe

Filesize
468KB

MD5
27377a6364ae9417c40d2e5e7ab33af1

SHA1
0374827aab0a62eb109f871cc5a8396337c7a68f

SHA256
3c23020479145c07b940eab55d63b60c91fdf89e4c3ddf27ae7e9ac94627a8c2

SHA512
fef8684688352abac0ccba6a95c6eabaa6c75b29c4627736de5a9f23972015335643ef722339e28e80f6a306165a46cbdb0af5e578b8bfd8e584652f03539cdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7754.exe

Filesize
468KB

MD5
22b61a2b342dcae14893d4f2f278a862

SHA1
2bbe723e6fbdcd78e87dac602444bcb0abf509e5

SHA256
d5de0ea4cb9d8ffbd4ee93f4a305d9452f361837ab67ad90cd75bc3f5f797e74

SHA512
65d4d1c7d5d25bfdb1ad8bc820a798c9a083a61058416c6fefbe86764b2215d0562e73c318529243abee5ba0c60eec277c2034274d1c97632ed6baaebfd41f76

Download Submit
memory/116-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1008-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3180-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3904-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4060-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4152-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4672-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13488-2453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15080-2662-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads