776b2c29f6894de0f2e89e5f1ac14ebce112277f1836ce1c8beb4862800233de

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70aff4228fd6499d8e659762c89efae0N.exe
Size

468KB
MD5

70aff4228fd6499d8e659762c89efae0
SHA1

06f1a8fe3b44ebcd2af661f9e897a8211872e1f5
SHA256

776b2c29f6894de0f2e89e5f1ac14ebce112277f1836ce1c8beb4862800233de
SHA512

ebfe515beec0f46d89ede4d9d59d5c648f5b93ce3e6b4e47536d9a9979d10101639190bed02a9ae8b4d2e1415b7bb12817e7b11faa23bd4967a88b6ad676390a
SSDEEP

3072:zzpCo7L+jy8UEbY2PzGjof6iChqWIpPZmHevVW2VCSFx+fNYWlW:zzsoiLUENPSjof80brVCO8fNY

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2896	Unicorn-46910.exe
4436	Unicorn-46535.exe
1244	Unicorn-17624.exe
4740	Unicorn-12550.exe
3700	Unicorn-12550.exe
1952	Unicorn-32539.exe
3048	Unicorn-59212.exe
4364	Unicorn-19524.exe
624	Unicorn-35236.exe
984	Unicorn-55102.exe
4024	Unicorn-41973.exe
1556	Unicorn-31448.exe
4512	Unicorn-51049.exe
2828	Unicorn-28354.exe
1852	Unicorn-18011.exe
2064	Unicorn-9091.exe
4892	Unicorn-25816.exe
1144	Unicorn-39538.exe
5016	Unicorn-67.exe
4496	Unicorn-47083.exe
4320	Unicorn-1411.exe
2932	Unicorn-47083.exe
4820	Unicorn-47061.exe
3996	Unicorn-4675.exe
3504	Unicorn-40254.exe
2876	Unicorn-39989.exe
3896	Unicorn-27125.exe
3696	Unicorn-33679.exe
872	Unicorn-36480.exe
3692	Unicorn-7159.exe
1236	Unicorn-59515.exe
2436	Unicorn-21860.exe
4616	Unicorn-19342.exe
3016	Unicorn-55623.exe
1784	Unicorn-34251.exe
3188	Unicorn-19329.exe
4520	Unicorn-4964.exe
4624	Unicorn-55800.exe
848	Unicorn-12747.exe
2880	Unicorn-7117.exe
3888	Unicorn-41083.exe
4072	Unicorn-2084.exe
3844	Unicorn-17342.exe
1864	Unicorn-65089.exe
2008	Unicorn-65089.exe
416	Unicorn-896.exe
1880	Unicorn-15806.exe
2900	Unicorn-13537.exe
3436	Unicorn-27272.exe
2852	Unicorn-33403.exe
1440	Unicorn-15348.exe
4132	Unicorn-50927.exe
5008	Unicorn-31326.exe
952	Unicorn-42262.exe
2940	Unicorn-62456.exe
2704	Unicorn-47391.exe
1840	Unicorn-4672.exe
3248	Unicorn-58040.exe
2288	Unicorn-20660.exe
1360	Unicorn-18657.exe
4832	Unicorn-56312.exe
4552	Unicorn-56312.exe
1500	Unicorn-25269.exe
3676	Unicorn-5476.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
9212	6156	WerFault.exe	232
9212	6156	WerFault.exe	232
17764	1400	WerFault.exe	748
9744	16892	WerFault.exe	845

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33403.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18032	dwm.exe
Token: SeChangeNotifyPrivilege	18032	dwm.exe
Token: 33	18032	dwm.exe
Token: SeIncBasePriorityPrivilege	18032	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3520	70aff4228fd6499d8e659762c89efae0N.exe
2896	Unicorn-46910.exe
4436	Unicorn-46535.exe
1244	Unicorn-17624.exe
3700	Unicorn-12550.exe
4740	Unicorn-12550.exe
1952	Unicorn-32539.exe
3048	Unicorn-59212.exe
4364	Unicorn-19524.exe
1556	Unicorn-31448.exe
4024	Unicorn-41973.exe
4512	Unicorn-51049.exe
984	Unicorn-55102.exe
2828	Unicorn-28354.exe
624	Unicorn-35236.exe
1852	Unicorn-18011.exe
2064	Unicorn-9091.exe
4892	Unicorn-25816.exe
1144	Unicorn-39538.exe
4320	Unicorn-1411.exe
5016	Unicorn-67.exe
4820	Unicorn-47061.exe
3996	Unicorn-4675.exe
2876	Unicorn-39989.exe
872	Unicorn-36480.exe
3696	Unicorn-33679.exe
3896	Unicorn-27125.exe
3504	Unicorn-40254.exe
2932	Unicorn-47083.exe
3692	Unicorn-7159.exe
1236	Unicorn-59515.exe
4616	Unicorn-19342.exe
2436	Unicorn-21860.exe
3016	Unicorn-55623.exe
1784	Unicorn-34251.exe
3188	Unicorn-19329.exe
4520	Unicorn-4964.exe
4608	Unicorn-60600.exe
4624	Unicorn-55800.exe
848	Unicorn-12747.exe
3888	Unicorn-41083.exe
2880	Unicorn-7117.exe
4072	Unicorn-2084.exe
3844	Unicorn-17342.exe
1864	Unicorn-65089.exe
2008	Unicorn-65089.exe
416	Unicorn-896.exe
1880	Unicorn-15806.exe
5008	Unicorn-31326.exe
2852	Unicorn-33403.exe
3436	Unicorn-27272.exe
1440	Unicorn-15348.exe
2900	Unicorn-13537.exe
4132	Unicorn-50927.exe
952	Unicorn-42262.exe
2940	Unicorn-62456.exe
2704	Unicorn-47391.exe
1840	Unicorn-4672.exe
3248	Unicorn-58040.exe
1360	Unicorn-18657.exe
2288	Unicorn-20660.exe
4832	Unicorn-56312.exe
3676	Unicorn-5476.exe
3616	Unicorn-19211.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 2896	3520	70aff4228fd6499d8e659762c89efae0N.exe	89
PID 3520 wrote to memory of 2896	3520	70aff4228fd6499d8e659762c89efae0N.exe	89
PID 3520 wrote to memory of 2896	3520	70aff4228fd6499d8e659762c89efae0N.exe	89
PID 2896 wrote to memory of 4436	2896	Unicorn-46910.exe	92
PID 2896 wrote to memory of 4436	2896	Unicorn-46910.exe	92
PID 2896 wrote to memory of 4436	2896	Unicorn-46910.exe	92
PID 3520 wrote to memory of 1244	3520	70aff4228fd6499d8e659762c89efae0N.exe	93
PID 3520 wrote to memory of 1244	3520	70aff4228fd6499d8e659762c89efae0N.exe	93
PID 3520 wrote to memory of 1244	3520	70aff4228fd6499d8e659762c89efae0N.exe	93
PID 1244 wrote to memory of 3700	1244	Unicorn-17624.exe	95
PID 1244 wrote to memory of 3700	1244	Unicorn-17624.exe	95
PID 1244 wrote to memory of 3700	1244	Unicorn-17624.exe	95
PID 4436 wrote to memory of 4740	4436	Unicorn-46535.exe	96
PID 4436 wrote to memory of 4740	4436	Unicorn-46535.exe	96
PID 4436 wrote to memory of 4740	4436	Unicorn-46535.exe	96
PID 2896 wrote to memory of 1952	2896	Unicorn-46910.exe	97
PID 2896 wrote to memory of 1952	2896	Unicorn-46910.exe	97
PID 2896 wrote to memory of 1952	2896	Unicorn-46910.exe	97
PID 3520 wrote to memory of 3048	3520	70aff4228fd6499d8e659762c89efae0N.exe	98
PID 3520 wrote to memory of 3048	3520	70aff4228fd6499d8e659762c89efae0N.exe	98
PID 3520 wrote to memory of 3048	3520	70aff4228fd6499d8e659762c89efae0N.exe	98
PID 4740 wrote to memory of 4364	4740	Unicorn-12550.exe	101
PID 4740 wrote to memory of 4364	4740	Unicorn-12550.exe	101
PID 4740 wrote to memory of 4364	4740	Unicorn-12550.exe	101
PID 4436 wrote to memory of 624	4436	Unicorn-46535.exe	102
PID 4436 wrote to memory of 624	4436	Unicorn-46535.exe	102
PID 4436 wrote to memory of 624	4436	Unicorn-46535.exe	102
PID 3700 wrote to memory of 984	3700	Unicorn-12550.exe	103
PID 3700 wrote to memory of 984	3700	Unicorn-12550.exe	103
PID 3700 wrote to memory of 984	3700	Unicorn-12550.exe	103
PID 1952 wrote to memory of 4024	1952	Unicorn-32539.exe	104
PID 1952 wrote to memory of 4024	1952	Unicorn-32539.exe	104
PID 1952 wrote to memory of 4024	1952	Unicorn-32539.exe	104
PID 1244 wrote to memory of 1556	1244	Unicorn-17624.exe	105
PID 1244 wrote to memory of 1556	1244	Unicorn-17624.exe	105
PID 1244 wrote to memory of 1556	1244	Unicorn-17624.exe	105
PID 3520 wrote to memory of 4512	3520	70aff4228fd6499d8e659762c89efae0N.exe	106
PID 3520 wrote to memory of 4512	3520	70aff4228fd6499d8e659762c89efae0N.exe	106
PID 3520 wrote to memory of 4512	3520	70aff4228fd6499d8e659762c89efae0N.exe	106
PID 2896 wrote to memory of 2828	2896	Unicorn-46910.exe	107
PID 2896 wrote to memory of 2828	2896	Unicorn-46910.exe	107
PID 2896 wrote to memory of 2828	2896	Unicorn-46910.exe	107
PID 3048 wrote to memory of 1852	3048	Unicorn-59212.exe	108
PID 3048 wrote to memory of 1852	3048	Unicorn-59212.exe	108
PID 3048 wrote to memory of 1852	3048	Unicorn-59212.exe	108
PID 4364 wrote to memory of 2064	4364	Unicorn-19524.exe	109
PID 4364 wrote to memory of 2064	4364	Unicorn-19524.exe	109
PID 4364 wrote to memory of 2064	4364	Unicorn-19524.exe	109
PID 4740 wrote to memory of 4892	4740	Unicorn-12550.exe	110
PID 4740 wrote to memory of 4892	4740	Unicorn-12550.exe	110
PID 4740 wrote to memory of 4892	4740	Unicorn-12550.exe	110
PID 4024 wrote to memory of 1144	4024	Unicorn-41973.exe	111
PID 4024 wrote to memory of 1144	4024	Unicorn-41973.exe	111
PID 4024 wrote to memory of 1144	4024	Unicorn-41973.exe	111
PID 984 wrote to memory of 5016	984	Unicorn-55102.exe	112
PID 984 wrote to memory of 5016	984	Unicorn-55102.exe	112
PID 984 wrote to memory of 5016	984	Unicorn-55102.exe	112
PID 3700 wrote to memory of 2932	3700	Unicorn-12550.exe	113
PID 3700 wrote to memory of 2932	3700	Unicorn-12550.exe	113
PID 3700 wrote to memory of 2932	3700	Unicorn-12550.exe	113
PID 1952 wrote to memory of 4496	1952	Unicorn-32539.exe	114
PID 1952 wrote to memory of 4496	1952	Unicorn-32539.exe	114
PID 1952 wrote to memory of 4496	1952	Unicorn-32539.exe	114
PID 1556 wrote to memory of 4320	1556	Unicorn-31448.exe	115

C:\Users\Admin\AppData\Local\Temp\70aff4228fd6499d8e659762c89efae0N.exe
"C:\Users\Admin\AppData\Local\Temp\70aff4228fd6499d8e659762c89efae0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4672.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57016.exe
        9⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        10⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        11⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
        12⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        11⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        10⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        9⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19609.exe
        10⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        10⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        10⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        9⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17831.exe
        9⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        9⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50771.exe
        10⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        10⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        9⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        9⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2688.exe
        9⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        9⤵
        
        PID:18284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3760.exe
        8⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        8⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        9⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        10⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        10⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41161.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        9⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62300.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        8⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49988.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        9⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46842.exe
        9⤵
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        8⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19287.exe
        8⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        8⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21791.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        7⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55080.exe
        7⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21860.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32350.exe
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        9⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        9⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        8⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2056.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36414.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4337.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40552.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19211.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        8⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        9⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        8⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39461.exe
        7⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        6⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51972.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        7⤵
        
        PID:18732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4825.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        9⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        10⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
        10⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30012.exe
        9⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56984.exe
        9⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51423.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        9⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        8⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45249.exe
        8⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50021.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6080.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46516.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        8⤵
        
        PID:17668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        8⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        8⤵
        
        PID:18632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-810.exe
        7⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        8⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        9⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
        9⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13719.exe
        9⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        8⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        8⤵
        
        PID:17976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15418.exe
        7⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
        7⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35407.exe
        6⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 540
        7⤵
        Program crash
        
        PID:9212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 540
        7⤵
        Program crash
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34251.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        8⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        9⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        10⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        9⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        9⤵
        
        PID:19356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        9⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4318.exe
        8⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4074.exe
        8⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14226.exe
        8⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        8⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        7⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32688.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        7⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27728.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        7⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
        8⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23097.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31181.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11460.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49476.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        6⤵
        
        PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        5⤵
        
        PID:18008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44892.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57381.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30064.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        7⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
        6⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        7⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38934.exe
        6⤵
        
        PID:17172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        6⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        7⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64997.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        6⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15414.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        6⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        6⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        5⤵
        
        PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5888.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20737.exe
        9⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        9⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46430.exe
        9⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8289.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        7⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16932.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47556.exe
        7⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18053.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23617.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13582.exe
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        6⤵
        
        PID:19228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49613.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38891.exe
        5⤵
        
        PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11590.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
        7⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        7⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
        6⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59593.exe
        5⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        5⤵
        
        PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58977.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60706.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
        5⤵
        
        PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26573.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
      4⤵
      PID:16100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56312.exe
        7⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43003.exe
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54779.exe
        10⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        10⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57232.exe
        10⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        9⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        9⤵
        
        PID:16892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16892 -s 436
        10⤵
        Program crash
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        9⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30407.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17258.exe
        8⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21671.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63744.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        7⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15115.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46267.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        8⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12924.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        7⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6327.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22835.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        6⤵
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51896.exe
        6⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22648.exe
        9⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        9⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        8⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        8⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49673.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        8⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52541.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        7⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        6⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17491.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53879.exe
        8⤵
        
        PID:18508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52193.exe
        7⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        7⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23649.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        7⤵
        
        PID:18320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52344.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        5⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        5⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15194.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
      4⤵
      Executes dropped EXE
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11386.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        9⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30585.exe
        9⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36833.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30634.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62455.exe
        8⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32650.exe
        7⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5568.exe
        7⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        7⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe
        6⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        5⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49336.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39678.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61784.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3111.exe
        6⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        7⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        7⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        7⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43618.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12747.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31559.exe
        5⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        6⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        7⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64135.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34428.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        6⤵
        
        PID:19324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38769.exe
        5⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57656.exe
      4⤵
      PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7564.exe
        7⤵
        
        PID:18780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        6⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        5⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23818.exe
        6⤵
        
        PID:18480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51112.exe
        5⤵
        
        PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50716.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        5⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28374.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13049.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
      4⤵
      PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62224.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        5⤵
        
        PID:17988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      4⤵
      PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29159.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30715.exe
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55470.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59399.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        6⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21278.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10791.exe
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19393.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6856.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23766.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        6⤵
        
        PID:18804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21913.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13537.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        6⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        7⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2112.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37590.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47034.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15490.exe
        5⤵
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35777.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        5⤵
        
        PID:14720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17680.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37880.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27766.exe
        8⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63293.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        7⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        6⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53022.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        6⤵
        
        PID:18460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        6⤵
        
        PID:19236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2801.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        5⤵
        
        PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        6⤵
        
        PID:12560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        6⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5760.exe
        6⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        5⤵
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62927.exe
      4⤵
      PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59163.exe
        5⤵
        
        PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24845.exe
      4⤵
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      4⤵
      PID:17508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-957.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61974.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
        6⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9524.exe
      4⤵
      PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
      4⤵
      PID:17656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11070.exe
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29688.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31286.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        5⤵
        
        PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
      4⤵
      PID:17708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
    3⤵
    PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
      4⤵
      PID:9012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40208.exe
    3⤵
    PID:9840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24656.exe
        9⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 464
        10⤵
        Program crash
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26784.exe
        8⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6753.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53534.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        7⤵
        
        PID:17524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        7⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31326.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20542.exe
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
        9⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        9⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11900.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        7⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63476.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31254.exe
        6⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        6⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64446.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        7⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2346.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41058.exe
        5⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        6⤵
        
        PID:16364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        5⤵
        
        PID:17372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45502.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54245.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43486.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        7⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
        7⤵
        
        PID:17940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37242.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21086.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55230.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22938.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11361.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37281.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        6⤵
        
        PID:18372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        5⤵
        
        PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        7⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65428.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18121.exe
        6⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46089.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1865.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        5⤵
        
        PID:18544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-500.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8006.exe
        5⤵
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51913.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12385.exe
      4⤵
      PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52307.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
      4⤵
      PID:10208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
      4⤵
      PID:15432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54657.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24199.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32173.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        7⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21637.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7494.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12062.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        7⤵
        
        PID:17400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1312.exe
        6⤵
        
        PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12113.exe
        5⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        6⤵
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34215.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40966.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58753.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33604.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        5⤵
        
        PID:18744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        5⤵
        
        PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51774.exe
      4⤵
      PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
        5⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37898.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18837.exe
      4⤵
      PID:11152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
      4⤵
      PID:15696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-426.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        6⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20547.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        5⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1494.exe
        5⤵
        
        PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46437.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23422.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4601.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        6⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29610.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        5⤵
        
        PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30355.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14769.exe
      4⤵
      PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        5⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21942.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63962.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50927.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31928.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10060.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        6⤵
        
        PID:18668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        5⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        5⤵
        
        PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
      4⤵
      PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53431.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29728.exe
        5⤵
        
        PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
      4⤵
      PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
      4⤵
      PID:17952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34488.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29085.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
      4⤵
      PID:11172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29210.exe
      4⤵
      PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
    3⤵
    PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24477.exe
      4⤵
      PID:5072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
    3⤵
    PID:9372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    3⤵
    PID:15772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        6⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        8⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        8⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18970.exe
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        7⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        7⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53858.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        7⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64009.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63690.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        5⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        6⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26695.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        5⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22273.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65003.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47391.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53944.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58302.exe
        6⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12474.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64098.exe
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11977.exe
        6⤵
        
        PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36428.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47172.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        5⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        5⤵
        
        PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47814.exe
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        5⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        6⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19498.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
      4⤵
      PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8508.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        5⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
        5⤵
        
        PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9439.exe
      4⤵
      PID:18380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9221.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29246.exe
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50465.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7671.exe
      4⤵
      PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63259.exe
        5⤵
        
        PID:18000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
      4⤵
      PID:18288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
    3⤵
    - Executes dropped EXE
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        6⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47790.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43858.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        5⤵
        
        PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15722.exe
      4⤵
      PID:17808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32606.exe
    3⤵
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        5⤵
        
        PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
    3⤵
    PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54142.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53700.exe
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46510.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6259.exe
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25695.exe
    3⤵
    PID:15400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        6⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54104.exe
        7⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52651.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18333.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10885.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56705.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
      4⤵
      PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6263.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        7⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55073.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        5⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55504.exe
        6⤵
        
        PID:18500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45035.exe
        5⤵
        
        PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61505.exe
        5⤵
        
        PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20026.exe
      4⤵
      PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exe
      4⤵
      PID:17232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23703.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31146.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48164.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46973.exe
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57976.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58270.exe
        5⤵
        
        PID:17128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46476.exe
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
      4⤵
      PID:11776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33857.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        5⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2130.exe
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54071.exe
        6⤵
        
        PID:18624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20631.exe
        5⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46440.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52648.exe
      4⤵
      PID:11832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
    3⤵
    PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
      4⤵
      PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
    3⤵
    PID:10076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
    3⤵
    PID:5856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55800.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
      4⤵
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22140.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14089.exe
        6⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        5⤵
        
        PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8640.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59969.exe
        5⤵
        
        PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
    3⤵
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
        6⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36778.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2083.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
      4⤵
      PID:17692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20165.exe
    3⤵
    PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49920.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5146.exe
      4⤵
      PID:17960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
    3⤵
    PID:8848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
    3⤵
    PID:12836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51348.exe
    3⤵
    PID:17932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7117.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56385.exe
    3⤵
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57467.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38657.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53912.exe
        6⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7902.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        5⤵
        
        PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        5⤵
        
        PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17060.exe
      4⤵
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43748.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35076.exe
      4⤵
      PID:15708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
    3⤵
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20915.exe
      4⤵
      PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37083.exe
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46668.exe
    3⤵
    PID:10056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
    3⤵
    PID:14412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14064.exe
    3⤵
    PID:13328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54676.exe
    3⤵
    PID:18696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
    3⤵
    PID:5704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13942.exe
  2⤵
  PID:5180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
      4⤵
      PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64734.exe
      4⤵
      PID:18400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
    3⤵
    PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64049.exe
    3⤵
    PID:3944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
  2⤵
  PID:7252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
    3⤵
    PID:4000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58038.exe
  2⤵
  PID:11144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
  2⤵
  PID:15740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6156 -ip 6156
1⤵
PID:8576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6156 -ip 6156
1⤵
PID:9612

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12550.exe

Filesize
468KB

MD5
e58b04513b883edae5f56d26a3a8b4b1

SHA1
d0bc5717c91d805d4a85fcaac152ca1739700b0a

SHA256
c3d6720e413c17c46e33ea5808ae475d4aa00008fc7a058201c9697507b6115c

SHA512
4cc0b7b8c22bc51ca9531a0422d1a78cfc4bfde6d9abd12d2e7405d84751fd6e38be123338c7e79587344ba96e391e80c6ca319eecdee8b1bee5d6ed56ecad02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1411.exe

Filesize
468KB

MD5
049008392165b4d41290e5bf9581cbff

SHA1
e1a2c14f835d4a44af371cd3c1e9172a2ff9cc89

SHA256
0f5186b5f35be23a3d6a957d403e357625f19cd49b515a1d75ee02e125b09387

SHA512
2730fd2cca896cd9e1b2f16a8964510855952d216a80f137e8b3ea2f1515d0f15cfe7425b8d4150c59dbee62b6d0df459e5943ef1e6211cfd4df33d0a2c38264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17624.exe

Filesize
468KB

MD5
01e2b38098b89684758a0556455102c7

SHA1
55318200c59b163c6aad63539bf010f0cd4e2f60

SHA256
b03a68648e8fc32c0c8a5a0f5ec6bdca3b04c24339d64dacd18fa22ad1bc25f7

SHA512
cf5afe0c77c63a5b4e8e125fcf088fe5939d0e1ebc9fdbba5deed7c7f280d7e59cba445a7af854c6a63de5a98961e50f6b65d4ada976a48a5b5327eddfd01233

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18011.exe

Filesize
468KB

MD5
3a5cb124043463d5dd6f6e0193357109

SHA1
a2f27bb4df1028bbdc68844e39d1284ff45c4137

SHA256
8bf2a42055caf145b8c1fcb6a8ecc9593a7f082f12c5fce73dac07412e5e5f39

SHA512
ec14e8526082d167d2bf8b5b45d8081424f622815c94ec87f37b3d05a13ef305d9c5a5fa8234bd8dabe4af22f5c42d8f69d35c33ea0aa75a890bf41eacf4eab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe

Filesize
468KB

MD5
bf830c994503bdab27a17fada0f3c2eb

SHA1
7f028a4244474fb5b79bdd8870fe1b54b005177e

SHA256
16fc7506148773de7365be6fb7998cb0ab967c273ee58af3c64cf217fc12105f

SHA512
683caeb45cf7ce54b52cc3e9f01fc3c207ac475b3775aa7445020d3688330a5f02bc94a511c55e4d058be6ddd7e61afca8331a41116b60ef7428b7cb5dfc8aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe

Filesize
468KB

MD5
5a50b37dc5c52e0bb5356a35e882a523

SHA1
d7b006aafb2d9b79a43cf1b8f79db38939bb0a40

SHA256
d4c8c4d957a45f5edf1c5bb8cda7c72be27c9a5e3b8aa9000c6bfc7ecbd6a4ba

SHA512
26bc68b2f63f3fd4e28e82034fe70a9983e358fc2e23b8f6c2675c5e248798359581c087876efb1f711a23fc3f07661759a77872f57bc3b4d6cad6847f17b7f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21744.exe

Filesize
468KB

MD5
2ff02bcc80cb5e31a7fe338caca4b1e5

SHA1
edd93dcc7a81e0a76cfb0bef5f73c294a5cd2cb5

SHA256
99ffc340244a20bca4d33cf1d64e9b70d61c22b88e6aa2a27639f72e0fee0d0e

SHA512
21095b8ef06a57e968e318a1d6885165e60760251b072bed5b76f69949735b74eb7fb2b28810824a6b54711d0759d55f6d08c008d59641b041f2c96522a0c85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21860.exe

Filesize
468KB

MD5
22f6ba6b167a9baa703089b998dbdc2f

SHA1
c4c9e7470d84a054a9c4200fad71b9cf112ae870

SHA256
19d26e2b74cec89a47779f60cb63dc91372720aac691649011c4055ef12dc599

SHA512
af74208e4acc2b95dffa9e6d1782b13243f0e573426015ff9e5bb03334ab65bfdc837074652d11252d9094cfa80e2652fe7a605655baf629098bdafee634d33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe

Filesize
468KB

MD5
942949116bf5b354bf4b372008babfdf

SHA1
3cacca1aa58fa6578dd5ce4dcd35d89cff0e0f8d

SHA256
fc498d6e703a2789d2aa81c30c488b448017787946072917c3cc27cb59941586

SHA512
74bb7847af27645ce7e6bf5809f8bf8478b8403d5ed3228e7271da6b443396369edf06cc68ec82bd1fca9c211136d352cc39bd15024580f2761eb98de9b0d38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe

Filesize
468KB

MD5
30addd4e51c5c8b988c637b347f7c44e

SHA1
13c5fcf57986cc0910e9ac3c7f36bb8710e5ec21

SHA256
4059777189b3619ebff046f93b5b9e4676d76119ec95d71a06cb6d594519c22f

SHA512
c9870351226387ae244e730c19ab32053b9f452a1ebec2291ece3e75ee700ab3f84dec5ab9b24da8617839020b5c34b38ebdad7f8107fa7e9d9dc9b4bb21a112

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27125.exe

Filesize
468KB

MD5
da3f4acf52001dc4a6b805aa0cecf582

SHA1
1ade2df9e1f70731dfc63c5d18a126f56e2e19fb

SHA256
fe40a068015f4ba713fbc9dadbca51e7c5c1691e040502987eb8ae5b6f7742dd

SHA512
30de77b475bdffee508da9b74683f28d143fb08111c16e6ac25001a2cf98a0760bbb6b4f0a05a4aed381d72effda77edb6ac8c7488778cc75c6542dca800ac71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe

Filesize
468KB

MD5
d981058685094edf5100bdebd464c15a

SHA1
ced915cb0c890004e3ece4fec208c9b8a4053e98

SHA256
2f9049966f138e8b85f5d10265e757b0276c9c03e3e8f2641b38dc715c5ad99b

SHA512
94db5733a0019a59ab8f53b9cf2acc5c027f31ce048e258d3da1553d13697274715987fb0d349594080d0d5c4d923832593463e2f751af1616b5525e09ff5e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe

Filesize
468KB

MD5
f60ac7339b42ed555c9edb65733d3c1b

SHA1
fe5c595a8ec0de95811711657d3116e6b15923d0

SHA256
16dc4409e07caa75b72774e5800dae143b417b136ea1127a5c7a31c9c1212327

SHA512
c7cc2b6048f02ea3da6686c59dfc4f6d0a50802e732250165df0c7011b3a539bc814a2914fb15ebcfab573bfc4a9a393cb2bb6619ef4f4ebab77a534c5477070

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32539.exe

Filesize
468KB

MD5
eaf1423f02b33147585068c4d2e689aa

SHA1
93a45a67ef715a60e5e3f55bf47682e2da8bcec2

SHA256
a673eb8a3c13f80e6f72bdb7a2912e0bdd3d72d7ec6db8830cdab81b630b727b

SHA512
38e1ee4494b15ddd8967419e2df27c6a6e99e97320151a19d2ace933a2f923064625406acea173f936cdb2f1848e3cf2ded0e7b7164dd915a8768241240fd46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe

Filesize
468KB

MD5
f697b61b2701311a4c8d3d6f26c5219c

SHA1
6194aaa06070a259b50e3be9b875ca8ae7bb8c6f

SHA256
1da62374f01e3391798d8a55b1365eec4ff17246cfcc1ec5e64f4300cf168975

SHA512
1016eee487ce178d3c6614f8ad0685bcf0dd3fba56f179301ed9b496d62e9ba6c487ac7e94406e17f5dce9db33ea814a07c73db66fb313e01886c48fe5d4e83d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35236.exe

Filesize
468KB

MD5
052e319ae2f2f6a4a4fc365134a12d0b

SHA1
9925fc111264ccaae1a5a337e81d09c5af3812dc

SHA256
bb1b04ce430e6b4934566610077ea374848fb13ed2cb6224d9e71d1e79165bdf

SHA512
c601b93310bf032fe1993bdc858ad11f89844cf539d7765d824a72c555b1504e2b4830aec582847fc71bc6eb6c5721bb5392c8398cc7fc94f2f2d457caa7415b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36480.exe

Filesize
468KB

MD5
eecc22992551e078a6e4eb546aebd324

SHA1
7755c63ddd8fac3cc1d45c7e37bb4538782a6dfb

SHA256
511d4576e95fbe323d889f3563c9e0fcc1030266f3a820304006d73fbf78e61d

SHA512
9b59b609a8aa7d2d352fac0933d98c69ab4070eba43fd5ccdbe67ebcc9a28c2e3d60c82ea2a9eadc4684039bf755e2859700d6beb260ce69405fcaba331fecaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39538.exe

Filesize
468KB

MD5
078a6aeacdae14dfb225fe23823b6c22

SHA1
f398c3f1aa9976e0c935c7ab6472c4fe6bed5443

SHA256
39d843ad9aa85098464155bfe7620064fea187103968055ec6354ba0fc7317f3

SHA512
9ceb564406046f2d2e6b5b14f9c71e5d3229c58f5ea2d601f412c104a052f2c73cdd47ac00718da4257d836f69d129d9eb5bf818ea34a69f167198e1533edf5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe

Filesize
468KB

MD5
2fcea4f1acdc94ebc34b20912577b962

SHA1
aff8f2d59c36d7579b9d2c1ab4c2e5241b5473cc

SHA256
d3ba1e307a5446038816f10e4c05ca9e8b2c677f8a7f7882fb52858f1e4e97aa

SHA512
0a8d1f32db45c2030a8e8558adfa2197bbed76b8ffae8e2b246dda80f716b79c5ad662a444f5581dff38d3be4f4c5e9da8a7b457684fb9ef70f937ecbb28b7c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40254.exe

Filesize
468KB

MD5
de5b1b6bd64f1f7b6d6177f888dad5dd

SHA1
39c65aa9e2f64022bcdca5326dfb17a04deb8f97

SHA256
6d82ab804ce86a1c33cf6671c47b729754ddc8e3683b26675f7e323fc6e66207

SHA512
f8b3fcfe1b33e19c248510f5e00f6b8e60c63461e054b1a0ec4233ec5bb1c603874007678df941f671208d36b1f4014dd3373e92ea9f9c83d8c2ec39230c6d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe

Filesize
468KB

MD5
4c50d1f546493ff467014f47506f53f2

SHA1
6d07b75cc57b63dd95e4a486b9628c9d131d9049

SHA256
dc0665dd0e10110300b32d4de88ba1c3324ac031bd63f2ce41766ab1d4dc3723

SHA512
5c4780e3995bb00cbd96f0418fc95a023eae49b702e2a5d697b0a0b4b676de62cecf533b6eacc4fbf47a22c5de2881a61bd6eea7fbf3d8c5f762889ca1205fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46535.exe

Filesize
468KB

MD5
657c770f9a46376d41952a247fb545f3

SHA1
1596321427b34adb9b5585a991a38edebd9c34f2

SHA256
5639bff915c563d9258039989cefcc4e8db39caf59bd912e8b4691c6fef20714

SHA512
1b921baa7c36407bf649ed061a37e72ab3c95057330fc234e1660fcad979d4278fc4faca133a525f03c1f58b9fa71059ccf01f6f76054dba802a2f1afdf9c90e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe

Filesize
468KB

MD5
9d47ad19c4d460568cdde3acaedb49a9

SHA1
447280d6cb30c51cb26ee46952007df1d6e7fac0

SHA256
d579597768b9880aa9942a6918eb96be66d639b2b91128de814bf4f523f1a083

SHA512
5326b2b0c1878138e19eee09d9452abbb9aa28be8ce4ebdd3ddd7ab94c25e7a1b0b28e6bc68acccab7db9c4d43a99929fd2a0693a741a762fde49350448915ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46910.exe

Filesize
468KB

MD5
286e0e4933c52a1d2cd9dadd413a5908

SHA1
537af39d8d918b56d530ef5f6c0b60686781f90e

SHA256
9d85a8023aa4e8658583effbe57d8dedfd71dc96f6abe8591c30bcf4e35ebad8

SHA512
c1897f8ae3f59b505ca03164d592f4439c0f3b202aa0a5f4391639cc4f7dcdcbc17c28f6d0e6313be5a1169a2e1f4b0e97a89d6a22b50c91840f850c423c5e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe

Filesize
468KB

MD5
42dafc513bf2d48e47b423038e7a3401

SHA1
dcf18ab9c662ab9c6d6383d2256163ff935dab29

SHA256
68bb8dfc93436a2685b5006cf35ca1df33d8bc81b3f93a0db5810825c5da955d

SHA512
de82ad81fda29137a23de589ccfaecb158564a5ffe2a68a1e4dd96744585ba26445a9328b5b0baca67ef41ae143c6bfddd3df00a22590d33947d9f22ee1828fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47083.exe

Filesize
468KB

MD5
f06f1bd1a44fa496c2ea9000443081d3

SHA1
5b33166d71619c328d743db926701ad5d3ffcbdc

SHA256
407f7b3ba522bb7cf6362dc781f84771382cf9e77bc4567376e6a793510e7bf0

SHA512
6a8571a0c0ce9b5e4563babd1e08e4161cd3e04c9d5c511e359f6c2f693576f5239a43fa1a013e825bb41d4e672d6f27f174e65bb56a9290df4517163be3a3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51049.exe

Filesize
468KB

MD5
0707322412c29656ba2c95d608941107

SHA1
e78144e2a89051f3ce8b3aea24b1ed58d20e4155

SHA256
1df05b12352631440223a10c2de99ec9af9bd38fd15f8af8fbe8f27a01654db7

SHA512
8064e821ed93bfcc02a57ec838bea4f48d50cd5669329b06a1f2bc80aa72f338d0f6ccc518d9cd50718eff462e0cfa4cd9c5b70193310a08bc21f4b2db38beb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55102.exe

Filesize
468KB

MD5
3d9c9a1d4d18d2029a699afed8bacdea

SHA1
7e40a314091f9011df6875100717ee9c86b61325

SHA256
cfd2736fd7cb1e1a4c56460a21ff9cd4b11ff041bdd7e755be3837c2e09dcd68

SHA512
39f9e7be6a7681dfb64cfd8e31a22b81152d2a175d2cabe6a138001a4f832846b2c33ba416da228857f36716835805207dcef86dbd99c110e36f8b0234c98fe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59212.exe

Filesize
468KB

MD5
70a92510d955da6d41c640c434843782

SHA1
023193b0bae84d8a102ecde552e665a6d120feb7

SHA256
90528b65feb85e92a1084581c265406a9a8bcaeff0c8406c317b7b10d2d86c39

SHA512
2d1f5800819feaad22a5ecdb8da99cc93af2f33a5ac11b1cacb4e0a313046bee7616041d9d2aa4bb4c744c00ca9767aaf6bff7bfdc028f798a65086876db7826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe

Filesize
468KB

MD5
f2cfdbf23de77b111c3f809176d26e5a

SHA1
031b5b2be45406889ee70e80db5f5107ee396307

SHA256
76ba743286b09d231b4a34a63187c9cdea26e98171757df4e0fd5c757a5d3cdb

SHA512
633dd62820cc2842fd642eade8752dee810ea019397af0b03f32068341e9719d307d09ac0f8e15266d339d230920db958a67196bd6aac7b736c6eb09e8caa616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe

Filesize
468KB

MD5
d415f3c353e6874fb4485527a7d32179

SHA1
b668c5206a2cde4ad96a34b9a8e9584603ba9319

SHA256
6f25cb528e452b7bad0a21af183f2fe41f9733312f93eb06d34076cb28635931

SHA512
2dec49184ecbaf9b9d6d07d99726ef1d675f223af44bc5c389077fc97595ad003748fffefdc7b5f5867aef495c4daa5a272e36c422914e375b6bfb8b1c9e55ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7159.exe

Filesize
468KB

MD5
e25c65f21f003a66eb8ee0e0397d27ca

SHA1
1fc040320d375469521528e621bcef933d405a37

SHA256
a2e38f0b314e2cf8cab852143bd3adce056352cd7b4623d06e7eddb2996bbccb

SHA512
cb2e784e60f225b6dd22f9e36e5d91040b1310915841e53a0dbed68e4f23b8ae10e1b948c53f6411969c35bf0853a1aae8859743ebd510ff64a390460dbe4634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe

Filesize
468KB

MD5
367333b0bdf8b747fcf0f216a4cdfff8

SHA1
873d50debcb62585d5de33d75fa9d0cf3b7c9fd6

SHA256
4090c0dbd7ddc94a36b3d9d926ac2693aaf6ca387f84687d9176bf3003d77eb2

SHA512
b9cad677cfeda07321e6d0304a373dea411f820c683930ff55d4b9b0c21ca8af2af7453fa62dd2f0e0dd34c3dc60270d9175116734383cf34a0a2d3f88520b8f

Download Submit
memory/416-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1784-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2008-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-2461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3016-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3092-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-2451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3700-2405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3872-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-2463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-606-0x0000000002FD0000-0x00000000030AB000-memory.dmp

Filesize
876KB

Download
memory/4496-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-2450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5456-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5596-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-3485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5808-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5816-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5824-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5836-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5920-3835-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6652-3392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7064-3486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7424-3399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7592-3400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9320-3595-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14520-2406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads