264c4e0fbff6c4d062d420081b767f51acae3723f34a9f5ca6ad8360afc62eeb

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a48d2ee95990c02f4339e896d3572a0N.exe
Size

184KB
MD5

4a48d2ee95990c02f4339e896d3572a0
SHA1

2075cf081d07d914d0d4cfb3812045e2693ecf30
SHA256

264c4e0fbff6c4d062d420081b767f51acae3723f34a9f5ca6ad8360afc62eeb
SHA512

58935eb48ce85849bea820e135d3fd6b7003c062e7a30129e5f8fd25088e4a8f8076c4e50bdced087645a74bdbf5815bcbb775efbb6738c5b504d7d9b6feb88c
SSDEEP

3072:xKovKkonKwWodHxZW0Cc8sajalvnqnxiuw:xK+o0UHxt8fjalPqnxiu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2632	Unicorn-13936.exe
4860	Unicorn-29137.exe
2868	Unicorn-28814.exe
4184	Unicorn-28424.exe
4856	Unicorn-9072.exe
2252	Unicorn-54744.exe
4864	Unicorn-55350.exe
3976	Unicorn-33064.exe
3820	Unicorn-33064.exe
2628	Unicorn-26903.exe
2308	Unicorn-46769.exe
4164	Unicorn-26903.exe
2984	Unicorn-46769.exe
640	Unicorn-46696.exe
964	Unicorn-40831.exe
1380	Unicorn-17704.exe
4216	Unicorn-30894.exe
812	Unicorn-30894.exe
4820	Unicorn-55921.exe
1676	Unicorn-33861.exe
888	Unicorn-8173.exe
3808	Unicorn-8173.exe
4196	Unicorn-50367.exe
2464	Unicorn-4373.exe
4288	Unicorn-10503.exe
4972	Unicorn-23752.exe
1516	Unicorn-23694.exe
4660	Unicorn-23694.exe
1248	Unicorn-12174.exe
2404	Unicorn-18391.exe
1456	Unicorn-56046.exe
3036	Unicorn-56046.exe
1224	Unicorn-35953.exe
1432	Unicorn-34238.exe
3392	Unicorn-34430.exe
688	Unicorn-53560.exe
1540	Unicorn-60680.exe
5000	Unicorn-39252.exe
4560	Unicorn-31345.exe
5028	Unicorn-51007.exe
1180	Unicorn-65169.exe
4044	Unicorn-4151.exe
3948	Unicorn-29809.exe
3968	Unicorn-42999.exe
3492	Unicorn-30385.exe
4056	Unicorn-63441.exe
628	Unicorn-48366.exe
1216	Unicorn-28500.exe
2576	Unicorn-30638.exe
4760	Unicorn-50504.exe
4036	Unicorn-53503.exe
5088	Unicorn-61151.exe
4648	Unicorn-1936.exe
3332	Unicorn-26062.exe
64	Unicorn-60369.exe
4112	Unicorn-54431.exe
4976	Unicorn-13694.exe
3836	Unicorn-38216.exe
2776	Unicorn-35350.exe
2916	Unicorn-38382.exe
3736	Unicorn-1495.exe
1808	Unicorn-1495.exe
556	Unicorn-53903.exe
836	Unicorn-13488.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1912	7512	WerFault.exe	402
17664	7732	WerFault.exe	320

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28081.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5128	dwm.exe
Token: SeChangeNotifyPrivilege	5128	dwm.exe
Token: 33	5128	dwm.exe
Token: SeIncBasePriorityPrivilege	5128	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2728	4a48d2ee95990c02f4339e896d3572a0N.exe
2632	Unicorn-13936.exe
4860	Unicorn-29137.exe
2868	Unicorn-28814.exe
4856	Unicorn-9072.exe
4184	Unicorn-28424.exe
2252	Unicorn-54744.exe
4864	Unicorn-55350.exe
3976	Unicorn-33064.exe
3820	Unicorn-33064.exe
640	Unicorn-46696.exe
2628	Unicorn-26903.exe
4164	Unicorn-26903.exe
2308	Unicorn-46769.exe
2984	Unicorn-46769.exe
964	Unicorn-40831.exe
1380	Unicorn-17704.exe
812	Unicorn-30894.exe
4216	Unicorn-30894.exe
4820	Unicorn-55921.exe
1676	Unicorn-33861.exe
4196	Unicorn-50367.exe
1516	Unicorn-23694.exe
4288	Unicorn-10503.exe
3808	Unicorn-8173.exe
888	Unicorn-8173.exe
4972	Unicorn-23752.exe
2464	Unicorn-4373.exe
4660	Unicorn-23694.exe
1248	Unicorn-12174.exe
2404	Unicorn-18391.exe
1456	Unicorn-56046.exe
3036	Unicorn-56046.exe
1432	Unicorn-34238.exe
688	Unicorn-53560.exe
3392	Unicorn-34430.exe
1540	Unicorn-60680.exe
5000	Unicorn-39252.exe
4560	Unicorn-31345.exe
5028	Unicorn-51007.exe
1180	Unicorn-65169.exe
4044	Unicorn-4151.exe
3948	Unicorn-29809.exe
3968	Unicorn-42999.exe
3492	Unicorn-30385.exe
4056	Unicorn-63441.exe
628	Unicorn-48366.exe
5088	Unicorn-61151.exe
1216	Unicorn-28500.exe
2576	Unicorn-30638.exe
4036	Unicorn-53503.exe
4760	Unicorn-50504.exe
3332	Unicorn-26062.exe
4648	Unicorn-1936.exe
4112	Unicorn-54431.exe
64	Unicorn-60369.exe
4976	Unicorn-13694.exe
3836	Unicorn-38216.exe
2776	Unicorn-35350.exe
2916	Unicorn-38382.exe
3736	Unicorn-1495.exe
1808	Unicorn-1495.exe
556	Unicorn-53903.exe
656	Unicorn-13488.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2632	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	88
PID 2728 wrote to memory of 2632	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	88
PID 2728 wrote to memory of 2632	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	88
PID 2632 wrote to memory of 4860	2632	Unicorn-13936.exe	89
PID 2632 wrote to memory of 4860	2632	Unicorn-13936.exe	89
PID 2632 wrote to memory of 4860	2632	Unicorn-13936.exe	89
PID 2728 wrote to memory of 2868	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	90
PID 2728 wrote to memory of 2868	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	90
PID 2728 wrote to memory of 2868	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	90
PID 4860 wrote to memory of 4184	4860	Unicorn-29137.exe	91
PID 4860 wrote to memory of 4184	4860	Unicorn-29137.exe	91
PID 4860 wrote to memory of 4184	4860	Unicorn-29137.exe	91
PID 2868 wrote to memory of 4856	2868	Unicorn-28814.exe	92
PID 2868 wrote to memory of 4856	2868	Unicorn-28814.exe	92
PID 2868 wrote to memory of 4856	2868	Unicorn-28814.exe	92
PID 2632 wrote to memory of 2252	2632	Unicorn-13936.exe	93
PID 2632 wrote to memory of 2252	2632	Unicorn-13936.exe	93
PID 2632 wrote to memory of 2252	2632	Unicorn-13936.exe	93
PID 2728 wrote to memory of 4864	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	94
PID 2728 wrote to memory of 4864	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	94
PID 2728 wrote to memory of 4864	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	94
PID 4184 wrote to memory of 3976	4184	Unicorn-28424.exe	95
PID 4184 wrote to memory of 3976	4184	Unicorn-28424.exe	95
PID 4184 wrote to memory of 3976	4184	Unicorn-28424.exe	95
PID 4856 wrote to memory of 3820	4856	Unicorn-9072.exe	96
PID 4856 wrote to memory of 3820	4856	Unicorn-9072.exe	96
PID 4856 wrote to memory of 3820	4856	Unicorn-9072.exe	96
PID 2868 wrote to memory of 2628	2868	Unicorn-28814.exe	97
PID 2868 wrote to memory of 2628	2868	Unicorn-28814.exe	97
PID 2868 wrote to memory of 2628	2868	Unicorn-28814.exe	97
PID 4860 wrote to memory of 4164	4860	Unicorn-29137.exe	99
PID 4860 wrote to memory of 4164	4860	Unicorn-29137.exe	99
PID 4860 wrote to memory of 4164	4860	Unicorn-29137.exe	99
PID 4864 wrote to memory of 2308	4864	Unicorn-55350.exe	98
PID 4864 wrote to memory of 2308	4864	Unicorn-55350.exe	98
PID 4864 wrote to memory of 2308	4864	Unicorn-55350.exe	98
PID 2252 wrote to memory of 2984	2252	Unicorn-54744.exe	100
PID 2252 wrote to memory of 2984	2252	Unicorn-54744.exe	100
PID 2252 wrote to memory of 2984	2252	Unicorn-54744.exe	100
PID 2728 wrote to memory of 640	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	101
PID 2728 wrote to memory of 640	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	101
PID 2728 wrote to memory of 640	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	101
PID 2632 wrote to memory of 964	2632	Unicorn-13936.exe	102
PID 2632 wrote to memory of 964	2632	Unicorn-13936.exe	102
PID 2632 wrote to memory of 964	2632	Unicorn-13936.exe	102
PID 3820 wrote to memory of 1380	3820	Unicorn-33064.exe	103
PID 3820 wrote to memory of 1380	3820	Unicorn-33064.exe	103
PID 3820 wrote to memory of 1380	3820	Unicorn-33064.exe	103
PID 4856 wrote to memory of 4216	4856	Unicorn-9072.exe	104
PID 4856 wrote to memory of 4216	4856	Unicorn-9072.exe	104
PID 4856 wrote to memory of 4216	4856	Unicorn-9072.exe	104
PID 4184 wrote to memory of 812	4184	Unicorn-28424.exe	105
PID 4184 wrote to memory of 812	4184	Unicorn-28424.exe	105
PID 4184 wrote to memory of 812	4184	Unicorn-28424.exe	105
PID 640 wrote to memory of 4820	640	Unicorn-46696.exe	106
PID 640 wrote to memory of 4820	640	Unicorn-46696.exe	106
PID 640 wrote to memory of 4820	640	Unicorn-46696.exe	106
PID 2728 wrote to memory of 1676	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	107
PID 2728 wrote to memory of 1676	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	107
PID 2728 wrote to memory of 1676	2728	4a48d2ee95990c02f4339e896d3572a0N.exe	107
PID 2628 wrote to memory of 888	2628	Unicorn-26903.exe	109
PID 2628 wrote to memory of 888	2628	Unicorn-26903.exe	109
PID 2628 wrote to memory of 888	2628	Unicorn-26903.exe	109
PID 4164 wrote to memory of 3808	4164	Unicorn-26903.exe	108

C:\Users\Admin\AppData\Local\Temp\4a48d2ee95990c02f4339e896d3572a0N.exe
"C:\Users\Admin\AppData\Local\Temp\4a48d2ee95990c02f4339e896d3572a0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60369.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18728.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        9⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        9⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        9⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        9⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
        9⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        9⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
        9⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        9⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        8⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31918.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        9⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
        9⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        8⤵
        
        PID:18160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40594.exe
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        7⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18728.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        9⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        9⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        9⤵
        
        PID:18084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        7⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61105.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4721.exe
        8⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        8⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
        7⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59116.exe
        6⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4017.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        7⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24977.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62299.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8718.exe
        6⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9159.exe
        6⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34223.exe
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe
        6⤵
        Executes dropped EXE
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5499.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        8⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        8⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        8⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
        7⤵
        
        PID:17712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
        7⤵
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        9⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11451.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35441.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38743.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20350.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        7⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52041.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        6⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23640.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        6⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        6⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44764.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45655.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15999.exe
        7⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14657.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63225.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52032.exe
        7⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44663.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        6⤵
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        5⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        6⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        7⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        5⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        7⤵
        
        PID:17452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29936.exe
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        6⤵
        
        PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        5⤵
        
        PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29809.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        9⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        9⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13327.exe
        9⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        9⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17350.exe
        8⤵
        
        PID:17800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34360.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20439.exe
        6⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        8⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32342.exe
        8⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38588.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        7⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4906.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20756.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11958.exe
        7⤵
        
        PID:18168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42591.exe
        6⤵
        
        PID:17632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58322.exe
        6⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2087.exe
        6⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55861.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25688.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61239.exe
        7⤵
        
        PID:17856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        7⤵
        
        PID:18004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41817.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        6⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        6⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4977.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41200.exe
        6⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        5⤵
        
        PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57624.exe
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16497.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        7⤵
        
        PID:18200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        6⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7512 -s 228
        7⤵
        Program crash
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53305.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63542.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        6⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26873.exe
        6⤵
        
        PID:18512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        
        PID:17636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64398.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50955.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57301.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50652.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        6⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63152.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        5⤵
        
        PID:18728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46256.exe
        6⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        6⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        5⤵
        
        PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29841.exe
      4⤵
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61551.exe
      4⤵
      PID:16124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29831.exe
      4⤵
      PID:17800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51854.exe
      4⤵
      PID:17160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30385.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        9⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        9⤵
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37410.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        8⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        8⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25696.exe
        7⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        6⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7373.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47040.exe
        8⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        8⤵
        
        PID:18456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        7⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        7⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        7⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        6⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        6⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25867.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9581.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        8⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49623.exe
        8⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        7⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        7⤵
        
        PID:18600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33681.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        6⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50443.exe
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        7⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30856.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        5⤵
        
        PID:18028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62744.exe
        5⤵
        
        PID:18520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        6⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        7⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55133.exe
        7⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33646.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23662.exe
        6⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        7⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33393.exe
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        6⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
        5⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61192.exe
        5⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18575.exe
        7⤵
        
        PID:17136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60998.exe
        7⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48949.exe
        5⤵
        
        PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33128.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        5⤵
        
        PID:18036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50761.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1610.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        5⤵
        
        PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21111.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
      4⤵
      PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
      4⤵
      PID:16164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56584.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28984.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        6⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17367.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        7⤵
        
        PID:16072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47417.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6861.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        6⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        5⤵
        
        PID:14636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35350.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24104.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5908.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        7⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62978.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        6⤵
        
        PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16660.exe
        5⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        6⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        6⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6631.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        6⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
      4⤵
      PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54190.exe
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33169.exe
        5⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12726.exe
        5⤵
        
        PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
      4⤵
      PID:14656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
        5⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53291.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        7⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15188.exe
        6⤵
        
        PID:344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
        5⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56215.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        5⤵
        
        PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32011.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6164.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31174.exe
        6⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        6⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53286.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        5⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48820.exe
        5⤵
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2765.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64528.exe
        5⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        5⤵
        
        PID:1132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        5⤵
        
        PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
      4⤵
      PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28559.exe
      4⤵
      PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7248.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8845.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53515.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23828.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        5⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        5⤵
        
        PID:18608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11963.exe
      4⤵
      PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
      4⤵
      PID:15004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48139.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
      4⤵
      PID:17868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60414.exe
    3⤵
    PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19243.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48304.exe
      4⤵
      PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
      4⤵
      PID:14016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14755.exe
    3⤵
    PID:10412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
    3⤵
    PID:14576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
    3⤵
    PID:14440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38382.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60305.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        9⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53870.exe
        10⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        10⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43785.exe
        10⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        9⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        9⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        8⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        8⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38711.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2509.exe
        8⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        9⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        9⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        9⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46905.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18591.exe
        8⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48625.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        8⤵
        
        PID:17788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        7⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1495.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26481.exe
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        8⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59015.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-246.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4744.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27735.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        7⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23998.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44206.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47947.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        8⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17823.exe
        7⤵
        
        PID:18112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        6⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1855.exe
        7⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3430.exe
        7⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63829.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9464.exe
        6⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-574.exe
        6⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
        6⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13488.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39496.exe
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        9⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42708.exe
        8⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
        8⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12276.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57145.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        7⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35650.exe
        7⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        7⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61769.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42568.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        7⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        6⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        6⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
        5⤵
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10042.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        5⤵
        
        PID:17788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33790.exe
        5⤵
        
        PID:18004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4664.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17772.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        6⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53579.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
        7⤵
        
        PID:17780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13246.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        6⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:19040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64236.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43535.exe
        5⤵
        
        PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        5⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37040.exe
        8⤵
        
        PID:18132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27771.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53760.exe
        7⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34114.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34449.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62485.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        7⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        6⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16558.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31031.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
      4⤵
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20145.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        6⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        6⤵
        
        PID:18844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47282.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9304.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
        5⤵
        
        PID:16748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33624.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
      4⤵
      PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
      4⤵
      PID:12680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
      4⤵
      PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
      4⤵
      PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63441.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40881.exe
        6⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5039.exe
        7⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44444.exe
        6⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
        7⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11797.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25888.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38996.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        7⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33583.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13723.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        6⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37582.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        6⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        6⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31554.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        5⤵
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        5⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        7⤵
        
        PID:17484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10086.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        6⤵
        
        PID:3312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2737.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31118.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10673.exe
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        5⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        5⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21716.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        6⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53445.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        5⤵
        
        PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35755.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46967.exe
      4⤵
      PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
      4⤵
      PID:18700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34286.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52562.exe
        7⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        6⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        5⤵
        
        PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13934.exe
      4⤵
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29512.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        6⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36640.exe
        6⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55015.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        5⤵
        
        PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27589.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
      4⤵
      PID:13872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
      4⤵
      PID:17976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
      4⤵
      PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        6⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        6⤵
        
        PID:19032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6612.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47783.exe
        5⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59215.exe
        5⤵
        
        PID:18688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
      4⤵
      PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12973.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52333.exe
        5⤵
        
        PID:18060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42700.exe
      4⤵
      PID:11844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
      4⤵
      PID:16108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58694.exe
    3⤵
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
        5⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31764.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34645.exe
        5⤵
        
        PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15761.exe
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1499.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3199.exe
      4⤵
      PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33768.exe
      4⤵
      PID:18764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48724.exe
    3⤵
    PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
      4⤵
      PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
      4⤵
      PID:17624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
      4⤵
      PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39547.exe
    3⤵
    PID:9676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29248.exe
    3⤵
    PID:13808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63160.exe
    3⤵
    PID:17924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
    3⤵
    PID:18472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13694.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51976.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8934.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        6⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62233.exe
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53527.exe
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19230.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54773.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        6⤵
        
        PID:17912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22103.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        5⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61013.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32222.exe
      4⤵
      PID:14124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53694.exe
      4⤵
      PID:18136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57408.exe
      4⤵
      PID:18504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9168.exe
        5⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
        6⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7732 -s 716
        7⤵
        Program crash
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3217.exe
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46464.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25680.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46392.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
        6⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
        6⤵
        
        PID:17868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28081.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32624.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51531.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8886.exe
        5⤵
        
        PID:17752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44421.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
      4⤵
      PID:14616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48584.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2903.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50834.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        5⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59846.exe
        5⤵
        
        PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
      4⤵
      PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9158.exe
      4⤵
      PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37333.exe
      4⤵
      PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26735.exe
      4⤵
      PID:18636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
    3⤵
    PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
      4⤵
      PID:17868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35636.exe
    3⤵
    PID:9972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
    3⤵
    PID:14048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20638.exe
    3⤵
    PID:18348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60680.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46737.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4170.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65454.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        8⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56711.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35708.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        6⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51794.exe
        6⤵
        
        PID:17800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12909.exe
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        6⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17048.exe
        6⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51100.exe
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46181.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19510.exe
        5⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31332.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57048.exe
      4⤵
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52110.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57287.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58279.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54841.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        5⤵
        
        PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        6⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        5⤵
        
        PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21455.exe
        5⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1589.exe
        5⤵
        
        PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8423.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29119.exe
      4⤵
      PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      4⤵
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
      4⤵
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52981.exe
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        6⤵
        
        PID:16772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4897.exe
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        5⤵
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64537.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24943.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-420.exe
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52751.exe
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8784.exe
      4⤵
      PID:17116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
    3⤵
    PID:3588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1198.exe
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55281.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2558.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24578.exe
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60071.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46450.exe
      4⤵
      PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
      4⤵
      PID:3084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
    3⤵
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
      4⤵
      PID:16940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49167.exe
    3⤵
    PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9105.exe
    3⤵
    PID:12036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12922.exe
    3⤵
    PID:13848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
    3⤵
    PID:16296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44031.exe
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
    3⤵
    PID:9324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3623.exe
      4⤵
      PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26632.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50763.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19814.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63680.exe
        6⤵
        
        PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28440.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        5⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63406.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13656.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        5⤵
        
        PID:17896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54972.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24322.exe
      4⤵
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55863.exe
      4⤵
      PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1672.exe
      4⤵
      PID:18540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
    3⤵
    PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10161.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49010.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
      4⤵
      PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4543.exe
      4⤵
      PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52793.exe
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41617.exe
      4⤵
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50583.exe
      4⤵
      PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26790.exe
      4⤵
      PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47682.exe
    3⤵
    PID:9664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
    3⤵
    PID:13816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7423.exe
    3⤵
    PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
    3⤵
    PID:18496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
    3⤵
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59147.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37908.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11734.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        5⤵
        
        PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
      4⤵
      PID:18708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60526.exe
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
      4⤵
      PID:18008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36633.exe
    3⤵
    PID:9416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23362.exe
    3⤵
    PID:13668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64778.exe
    3⤵
    PID:17760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6816.exe
  2⤵
  PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49553.exe
    3⤵
    PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27835.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
    3⤵
    PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
    3⤵
    PID:12164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1190.exe
  2⤵
  PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
    3⤵
    PID:8664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
    3⤵
    PID:12580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
    3⤵
    PID:17220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11337.exe
  2⤵
  PID:9440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:13640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48840.exe
  2⤵
  PID:17688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
  2⤵
  PID:18912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7512 -ip 7512
1⤵
PID:9612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1356 -ip 1356
1⤵
PID:16316

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:16232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe

Filesize
184KB

MD5
2b1aaecddb93360eeb7a424ffcda3b8e

SHA1
39450a0d95fd95c6aec07082c6ee3bbb4c9b1031

SHA256
a4843a88b2da453a5224235ab65cb63ef0db00549c681743eed1017767c3a890

SHA512
f4b2f4cf18dd4209fd695f269b7ac1b613d78b1848397e6f5c55bcae2d450c15220f390b6760f866d5e5223ab4d00d827b1dc827b5ac42517686d3e7ef4a61d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe

Filesize
184KB

MD5
ee06d1747e0a313912bad845306237de

SHA1
c7fa90aecdb29b1fca06a86df84631c16317dddb

SHA256
18467d0e9f2c4983c5fe1be6b40915498883d5736eea4620b8516478f8c108e3

SHA512
136227c6a2d9af1f2fae0e7a6ba43670100f5ff7328cad069187b92aa5bdfb0a0d522fb72413580784e96f2634ad31957a556f4dd04c2c822e6d530b6689815c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12174.exe

Filesize
184KB

MD5
4f93620f87c74f335051e1d385573b26

SHA1
644e90b5ee8b7342aa0e6ac0d4766a2d2018d17e

SHA256
0c01bb7b3f73d1f081d71f1dd702bed005bff613d77345cd1501d4627cab7fdb

SHA512
186c8fcd907742d9198588ad8b49d27317b833dd3859757b6eb1035da2132441e4061513d3ab850c23dee42a67b5c0956eeca9225f5cd47858addce1df555cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13936.exe

Filesize
184KB

MD5
3c1982854832c825d598063b3926a83c

SHA1
74fab1a1a217acee2ee4a510584f6321f8c234a5

SHA256
25567318d68ae225214fd01977cbe6b5f5ce83686c68aa6c2635bb181af2aac0

SHA512
75a60f9a109641f00eb77a3f6cbb7aeb1a9d42e0ca87606813989c5a459e1d04e9a0b9bbe13270fd854862e78785ba7a9e98030525e33bca3b388e4be961bb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe

Filesize
184KB

MD5
8469910c0b78dee70a4621a3376dd95f

SHA1
e80b56c233e4264c3dc045c45c79d931e07c44a6

SHA256
793519ffeea3770404ed818fa056582d3b8077a7aa56fb4aa230720d956fe689

SHA512
6732b7083a7e26d5ffd9397c85549a307cd818912818b06c5ab84e66140d583c9643c969308b9f6295d9fd1c8929553c33ae799b299df48f1231aa3d11610efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18391.exe

Filesize
184KB

MD5
ae139040fb0f3ad6280365ea8c5ad9ea

SHA1
bd5cd2e9c2c26a20cd7ff72f8a3728ccc999dc85

SHA256
bca49af30adc1e79264aeaf90d6530173d8d1fadacd313340a20ac2b63418495

SHA512
eaeaabb8aff0d249b0c6d2ca03929d0a85405f4f2c8d4ce4b4a505e2a3e4dba74eb17c4c313d249ac6a3314202e91159447e3b683076f535a8570c34e166befa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe

Filesize
184KB

MD5
57eeee2808d76f76dde4cc24ed459e0c

SHA1
05644d2fb0b4b35822ada033a65fa4914ecbf396

SHA256
77e9b5d4011fb29c62a0b1fa48845153be422e78710d829ce579e5530c6c1550

SHA512
82b63239dd3cd9458d72faadce5b03cb8f5f460239a16b6b33f0ca64bc317b03d534cf75e79b1f4e1455867aa3e19c70b854b2d3640560ab3f1b5614be605b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe

Filesize
184KB

MD5
b9c7aa1920fd8e5c05a80e7c448a2918

SHA1
5030711048f86646a32289e1bce8b63ecf7dec9e

SHA256
79d02e367716d605f036c80693f4b320f5ef85439583696b4e8e3cb8c9562881

SHA512
3db776e7c56accf0f876f1bcef8209d1ed89c4546284dfd46181aa3579f5c7f2c7b5e5da3e49b262b1aaaeda4d83416b680c1659f38fc551a857704ff4debb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23752.exe

Filesize
184KB

MD5
8aae7462e74ae71fbe00e3082285157c

SHA1
d4d3c0f3c35d2a15ff557f6762e069bea356980e

SHA256
795b28cbfa22660a1bab14179824e8519a72e2d05d2c57fa19cfc216edfcd006

SHA512
4278ecaf94f63233ad901034b21a79c2b9127f25536109a9e7f6a7f1b837e3223108ddba7f56c825ec28f83df4d795242f88ddb2273370bd92dcfcf163ff4d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26903.exe

Filesize
184KB

MD5
beff21af02fc9d8d4380746bcf93e473

SHA1
87b2f9dc8d1b7c3973a3625c62d8bfbf37b745d8

SHA256
c143f5272eb9d999a2e4d513f372b2764d5123d1b02aa95c50f57a02ee0c36b1

SHA512
214a894423044cdfbe41efc03389dec4eb74f7e1509a76956cbd38c7a55dc2cbabd11a112dc67215fa08139e05351253d95e56182c44da1b77063efbefb2a3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28424.exe

Filesize
184KB

MD5
bac9d05266cd12e048a5a5cf06ecdf05

SHA1
410b3076cef625b8e8f60c88d426a630f9b0cd51

SHA256
334e652e89d6dc4d62aa2333e2a553fad10514491c2c050561c918b88e5715cf

SHA512
3aeaa34e56cf4316568e5d22196af5919fcadf03b02d75f3eea2de64fb7fdb1e9b3ba03dc60dca9a45a1529f591de881da7b9bdcc284cb2e636eb81f3c1125bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe

Filesize
184KB

MD5
90bf2bd6fc68370057cd9a3802c7ebfa

SHA1
a605bebc816fcb6aa31d8f2d27ef41d8b4b3323f

SHA256
58d8f9cd740679a398c4a05b18ac5ea063cb65f152170c13e84cd2e00bc54c72

SHA512
0df44864ab21b2d97619b5caab13f363928cbe4ee31e0b13941139831f68e67bc8504c8fedf5af5a8653b38ddf3bf88e6a4e35d306000a0409e8fde7c1902959

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29137.exe

Filesize
184KB

MD5
5a250af3e480eefcb2adfcf667c4eb82

SHA1
4571604015c3b475714e5ea8a76b4c5e7f7735be

SHA256
6423be8b5f7540216fe857e01f120159d4e8b8ddc9a2dc2e7b463acf030cfc3a

SHA512
c6a5debb1f8fe45d9902d3700172d887b20214d11849d07b59748798562f17bdbc57218be8282bcc6d6fdb455d5ae8f2aceffea7377adc806fe2012a29dd2f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30894.exe

Filesize
184KB

MD5
fa004f4cdea3999de8606d86119cef70

SHA1
b75c06816f958754eb412b1ac7fb29d5e2dd05e8

SHA256
bbfcc741662b36e8b4af635a3fd535db533034df1bb21e08eeecd6dee192cbfe

SHA512
ec09a5872c2edc23189e052df8d9f5433e456ec3243ba24b715ee218ac4f5e5348811238ba087639ad5c0384f99cdb242774a6e1f28b2f700a4f484e8ab8e78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe

Filesize
184KB

MD5
a902c0e2c991ab7de4f686797a969519

SHA1
766087d0732caac3cceafc9bebc31a5f4d4cbbc9

SHA256
706500fe5665fa4d896606cd68740cbfab4cdde26e0ef47333bd7ead06965cec

SHA512
839f08384a3a46cfe5ea44b7a5ff244a86cf8f55345733502cca8453b54ba9a856fdcc8be66e93facbfda9ae2b5381e777556f2d74735f93b9218ac04071766f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33861.exe

Filesize
184KB

MD5
727ee2fd113723df8e056cc6e9156775

SHA1
33e44e27bc7b6f17d1e0aec8ca1a323c7c7ef548

SHA256
49dd70f86fa41fbb559d08e2b5cecb5b901078ae5e7bd1884597ed619d6a4bf7

SHA512
550e8a5337154ea90d9aaf8a31fe6a92dac9ab5f0e1e8f6903197ccd3cb315fd2c080bd0c2bac924a4f3e47cf9459515258c6137235c418162c67771b6a7e23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34238.exe

Filesize
184KB

MD5
d1a68bd19064b5fa77d4238335a4b753

SHA1
27dc2ebd3139f00e5d3f7394817f393cdde90e04

SHA256
141aca345687e2a13a5bed6d5d734dfffa0288ecc90b86459c8d9d2361420581

SHA512
25d794b1a01dac745b88fe1a2a9882fa1bfd9cf605f777fc3c28b97d1d2fa2d176d62b8fc5730c51fbbf1911c9ff32c1e9ac9d9d4703ba2e9c46afd1f2518e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35953.exe

Filesize
184KB

MD5
7cf27b71c73ced7c5d30019eaa960548

SHA1
a530409a5cb908c820d863193b5b506390954472

SHA256
e4927d1fac3a6bf77b59e147d026fc58853cb1568b97b0be82034e85ce6512e8

SHA512
35d62a77520aa08daa83bdef24619af2d30866551dd7a7c9df776fe55fee95591245e3a5e47a444a491c9933ddf55741fcc7345c295f84a5c819b2478b2f7d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe

Filesize
184KB

MD5
a5e47e9b1e79c92d51559694920e34a7

SHA1
068b467a678f4e35ff497c86b0ae8e382b93e505

SHA256
64a6dc93373a654ca1bdab45b021c3cca94e9eef3f79cee160a2f1d4b2eb7c1d

SHA512
140f46e3091e79bb12854ddf38e7aefdcfbea497aab579dc33c8a544fb5349fe0c3d10aca289d7adbd94b11bf981b9e6f4264b8615236a19261922fc4dd684af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe

Filesize
184KB

MD5
1b783bb994b29109d6bee5e80391b451

SHA1
8425d818ce8402e42112935f7a89f57697cd3a72

SHA256
8e780a97e1671ae861d59a1dae943fb9e936bcc71aed2fdf51249bb2c6cfe391

SHA512
95e87bbf6a5016644c2d3d485dec65e3b178769130bc973f5bf9cfc71b5a573677eff7626bf7c2342032398192c5a17c2121814ec869af24b2bb10845a4381e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46696.exe

Filesize
184KB

MD5
4e2cc0de46425226d76b43d05680b82a

SHA1
bfb9d8df81e4829b0147825e1c26a949e527c5c7

SHA256
6e00aeaa61baa10e159f4826537e16f4f6dded44aca503a978bf5ef911e75c85

SHA512
11993af0e7e9d063ae7829197af5a4f4bfbed7c2b51eb40166606c21b995be0bdf05e7392ea92788413ed9ef390d8b770347f7cba9cd3bb562350509b17a5fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe

Filesize
184KB

MD5
dead88ec933940df7d27f750449bd2c1

SHA1
e42691e6d0cdd165c75c74feb7d89168c8da9078

SHA256
6edd04badff56321a0337a7578eff827c21d35d517946bd1e0b0e7f6a12049da

SHA512
f0eb3684924996519dddc85ff5f154317af07d27ead89b7d5e17947990d7a306074681ded939575998893f41b2924758ee8ecc14d58d1df1c9b18661c6d9cfbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe

Filesize
184KB

MD5
0726c590771fb4c6f8144b30e9e36699

SHA1
6b580effb17b8ac33db79609a96e5b1f60849e5b

SHA256
31ea6a0f76219fc8857445ded82c0dca9ba498513a1db5d37800f634e1ca6194

SHA512
224e7b4b7b99652ddcde74c8036d8e86ea9d4d18c074cb28edd3177c05ad209961f073cf04daa8ba31cfd3fd2a1def91d95b905fe2d4d24f2c0d60c2b34f7a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54744.exe

Filesize
184KB

MD5
349771760893213cb55a9d043f385380

SHA1
f1add61d88824a687216d9697b3e5fcffd006b84

SHA256
ebc192a2bab9966dc6757c22eacc97b57da8596c92525dd6d378915a88600188

SHA512
8127f75979ec60a4ebdefedf8974f3708964ccd1b815ab73172c6b674b6cf847da17dd973af33f3a9016e85e35343ad263f75c2aa75056979120ceb219df684e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe

Filesize
184KB

MD5
1d3bfecfa876e48148dd095aa02884f1

SHA1
688f29169173128d808fee68f802325b3c3206aa

SHA256
6b6a1fc498d53c365ef14361b4f1cdee6c392d519e62dc2278356c334657f032

SHA512
640348f5abb8bf37bb1ae26135bd6606ce3d297ebc468a350c71f185e053cd1fea0cc0622290116c3b7b4deb78a424548e0a7e7d6dafd9ed2e6110965fd50150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe

Filesize
184KB

MD5
ee6675e6685ba8ba6501d19602a60636

SHA1
4046c12ed63a49f03c48e306c4b4f8f7692108d1

SHA256
2eba2e608fae4d67309832d5e4df59a780951308486fcde6e3aa68a84966e5f1

SHA512
0d7099fa6810f8d0d82163691173c8b03f52b31db3dd17ecbf35dab260bafbe71867ca9fc158463a4013acaef49e01325bf030ab6d5fa7c116bbb096056fe911

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56046.exe

Filesize
184KB

MD5
ebbde58e3a422913caef951c8eda4afb

SHA1
9c44167d58722eecdd97910a3ae1280937a4b57c

SHA256
a6891bea5ea66639b5512cf33ae6e77e716faec76dcf60522d31899b5cd35241

SHA512
47aad318d6a26b379cbdad5f05d667bd9b2ad21944418b8df337f1fe8b69a8544669b733ffae87164c1703b6aff32d457699aefacc795a5b242c5d4cddc07553

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe

Filesize
184KB

MD5
13084e88219e18963fae364fd9014af0

SHA1
a941aa1f4b6974172f1b7d3316bb59884d85810b

SHA256
e250473881662175980ad4d7fb9e1f36979caab0fd8a2e3eedfb6c1a29dc47e4

SHA512
e2df5e36a4f64fb737c18941218b28865d51fa2b19bd8c177edf2decf935fbdb8d4433954d80147a1e3fa208046b3ef70eda4e818f0f7436b1b5c7cecb1a58a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9072.exe

Filesize
184KB

MD5
04ce6d5b29094f0b0e3f88a5e4771278

SHA1
562adebefa411404e3753d968cc476c8f14a3d4c

SHA256
f55ec9e070c43335849e231540db798dd292689d9655b6ccb4d8dd99233b8c9f

SHA512
acc5164086061b9d078b1101e002e32151d32a1f960c41a6b6e9417994a0f9d36d0c67506248909aea6a14a9f3ce4f61d54d1c5cec0ee4a3de70688d4d9ea444

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads