585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3c

Analysis

max time kernel
117s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe
Size

184KB
MD5

d49d662f67aeaaa936d3eda920a95b80
SHA1

978001fa175c66050ff3100f3dd385e5c48852a8
SHA256

585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3c
SHA512

fd4abe883228f0689e1db4dc4a7358bf3bb23d87e864e09c1d95062cdf320a306e99a4d1134d6dd599b6b683a7d8c3dd662f66ff40110f0f70ed284c20fb1dbb
SSDEEP

3072:o1UZMso85MH6ZBy+WjTCQsWAolvnqnxiuX:o1Wo3CByEQrAolPqnxiu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1688	Unicorn-41277.exe
1392	Unicorn-28231.exe
2924	Unicorn-20617.exe
2552	Unicorn-57442.exe
1084	Unicorn-53358.exe
1576	Unicorn-28531.exe
2668	Unicorn-42267.exe
3008	Unicorn-14546.exe
1272	Unicorn-20254.exe
4540	Unicorn-156.exe
1572	Unicorn-156.exe
2364	Unicorn-25730.exe
3596	Unicorn-5864.exe
928	Unicorn-19599.exe
2772	Unicorn-47530.exe
3728	Unicorn-43602.exe
2460	Unicorn-58547.exe
1504	Unicorn-20167.exe
1992	Unicorn-39610.exe
1012	Unicorn-64276.exe
4048	Unicorn-53415.exe
2696	Unicorn-40094.exe
4184	Unicorn-10991.exe
4264	Unicorn-16773.exe
4348	Unicorn-25439.exe
4992	Unicorn-25704.exe
2796	Unicorn-40648.exe
3832	Unicorn-10528.exe
3732	Unicorn-42808.exe
4864	Unicorn-27026.exe
4536	Unicorn-10519.exe
3296	Unicorn-55536.exe
3280	Unicorn-8381.exe
3164	Unicorn-14987.exe
2356	Unicorn-62050.exe
2868	Unicorn-60104.exe
2296	Unicorn-9512.exe
3404	Unicorn-29378.exe
1536	Unicorn-38615.exe
4368	Unicorn-25294.exe
2968	Unicorn-38615.exe
3496	Unicorn-10711.exe
4996	Unicorn-15865.exe
1144	Unicorn-60881.exe
4916	Unicorn-41545.exe
3896	Unicorn-47146.exe
4540	Unicorn-10446.exe
3036	Unicorn-14530.exe
4764	Unicorn-20917.exe
2432	Unicorn-18117.exe
4280	Unicorn-7182.exe
3292	Unicorn-20917.exe
2832	Unicorn-64956.exe
516	Unicorn-26616.exe
1128	Unicorn-60872.exe
2004	Unicorn-19931.exe
3088	Unicorn-11479.exe
2052	Unicorn-22340.exe
4836	Unicorn-15563.exe
1724	Unicorn-27551.exe
1524	Unicorn-52019.exe
2612	Unicorn-62880.exe
3260	Unicorn-4956.exe
5032	Unicorn-46544.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
2300	4540	WerFault.exe	106
3960	2772	WerFault.exe	111
3896	1572	WerFault.exe	107
5276	3652	WerFault.exe	168
5336	3652	WerFault.exe	168
16952	16212	WerFault.exe	787
18888	15800	WerFault.exe	775
18756	16212	WerFault.exe	787

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38546.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23804.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2484	dwm.exe
Token: SeChangeNotifyPrivilege	2484	dwm.exe
Token: 33	2484	dwm.exe
Token: SeIncBasePriorityPrivilege	2484	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe
1688	Unicorn-41277.exe
1392	Unicorn-28231.exe
2924	Unicorn-20617.exe
2552	Unicorn-57442.exe
1084	Unicorn-53358.exe
2668	Unicorn-42267.exe
1576	Unicorn-28531.exe
3008	Unicorn-14546.exe
1272	Unicorn-20254.exe
4540	Unicorn-156.exe
928	Unicorn-19599.exe
2364	Unicorn-25730.exe
1572	Unicorn-156.exe
2772	Unicorn-47530.exe
3596	Unicorn-5864.exe
3728	Unicorn-43602.exe
2460	Unicorn-58547.exe
1504	Unicorn-20167.exe
1992	Unicorn-39610.exe
1012	Unicorn-64276.exe
4048	Unicorn-53415.exe
2696	Unicorn-40094.exe
3832	Unicorn-10528.exe
2796	Unicorn-40648.exe
4348	Unicorn-25439.exe
4184	Unicorn-10991.exe
4992	Unicorn-25704.exe
4264	Unicorn-16773.exe
3732	Unicorn-42808.exe
4864	Unicorn-27026.exe
4536	Unicorn-10519.exe
3296	Unicorn-55536.exe
3280	Unicorn-8381.exe
3164	Unicorn-14987.exe
2356	Unicorn-62050.exe
2296	Unicorn-9512.exe
3404	Unicorn-29378.exe
4368	Unicorn-25294.exe
1536	Unicorn-38615.exe
2868	Unicorn-60104.exe
3496	Unicorn-10711.exe
2968	Unicorn-38615.exe
4996	Unicorn-15865.exe
1144	Unicorn-60881.exe
4916	Unicorn-41545.exe
2432	Unicorn-18117.exe
3896	Unicorn-47146.exe
4540	Unicorn-10446.exe
3036	Unicorn-14530.exe
4280	Unicorn-7182.exe
3292	Unicorn-20917.exe
4764	Unicorn-20917.exe
2832	Unicorn-64956.exe
516	Unicorn-26616.exe
2004	Unicorn-19931.exe
1128	Unicorn-60872.exe
3088	Unicorn-11479.exe
2052	Unicorn-22340.exe
1724	Unicorn-27551.exe
4836	Unicorn-15563.exe
2612	Unicorn-62880.exe
1524	Unicorn-52019.exe
5128	Unicorn-30530.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 1688	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	91
PID 32 wrote to memory of 1688	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	91
PID 32 wrote to memory of 1688	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	91
PID 1688 wrote to memory of 1392	1688	Unicorn-41277.exe	95
PID 1688 wrote to memory of 1392	1688	Unicorn-41277.exe	95
PID 1688 wrote to memory of 1392	1688	Unicorn-41277.exe	95
PID 32 wrote to memory of 2924	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	96
PID 32 wrote to memory of 2924	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	96
PID 32 wrote to memory of 2924	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	96
PID 2924 wrote to memory of 2552	2924	Unicorn-20617.exe	100
PID 2924 wrote to memory of 2552	2924	Unicorn-20617.exe	100
PID 2924 wrote to memory of 2552	2924	Unicorn-20617.exe	100
PID 1392 wrote to memory of 1084	1392	Unicorn-28231.exe	101
PID 1392 wrote to memory of 1084	1392	Unicorn-28231.exe	101
PID 1392 wrote to memory of 1084	1392	Unicorn-28231.exe	101
PID 1688 wrote to memory of 1576	1688	Unicorn-41277.exe	103
PID 1688 wrote to memory of 1576	1688	Unicorn-41277.exe	103
PID 1688 wrote to memory of 1576	1688	Unicorn-41277.exe	103
PID 32 wrote to memory of 2668	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	102
PID 32 wrote to memory of 2668	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	102
PID 32 wrote to memory of 2668	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	102
PID 2552 wrote to memory of 3008	2552	Unicorn-57442.exe	104
PID 2552 wrote to memory of 3008	2552	Unicorn-57442.exe	104
PID 2552 wrote to memory of 3008	2552	Unicorn-57442.exe	104
PID 2924 wrote to memory of 1272	2924	Unicorn-20617.exe	105
PID 2924 wrote to memory of 1272	2924	Unicorn-20617.exe	105
PID 2924 wrote to memory of 1272	2924	Unicorn-20617.exe	105
PID 1576 wrote to memory of 4540	1576	Unicorn-28531.exe	106
PID 1576 wrote to memory of 4540	1576	Unicorn-28531.exe	106
PID 1576 wrote to memory of 4540	1576	Unicorn-28531.exe	106
PID 1084 wrote to memory of 1572	1084	Unicorn-53358.exe	107
PID 1084 wrote to memory of 1572	1084	Unicorn-53358.exe	107
PID 1084 wrote to memory of 1572	1084	Unicorn-53358.exe	107
PID 2668 wrote to memory of 2364	2668	Unicorn-42267.exe	108
PID 2668 wrote to memory of 2364	2668	Unicorn-42267.exe	108
PID 2668 wrote to memory of 2364	2668	Unicorn-42267.exe	108
PID 1392 wrote to memory of 3596	1392	Unicorn-28231.exe	110
PID 1392 wrote to memory of 3596	1392	Unicorn-28231.exe	110
PID 1392 wrote to memory of 3596	1392	Unicorn-28231.exe	110
PID 1688 wrote to memory of 928	1688	Unicorn-41277.exe	109
PID 1688 wrote to memory of 928	1688	Unicorn-41277.exe	109
PID 1688 wrote to memory of 928	1688	Unicorn-41277.exe	109
PID 32 wrote to memory of 2772	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	111
PID 32 wrote to memory of 2772	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	111
PID 32 wrote to memory of 2772	32	585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe	111
PID 3008 wrote to memory of 3728	3008	Unicorn-14546.exe	112
PID 3008 wrote to memory of 3728	3008	Unicorn-14546.exe	112
PID 3008 wrote to memory of 3728	3008	Unicorn-14546.exe	112
PID 2552 wrote to memory of 2460	2552	Unicorn-57442.exe	113
PID 2552 wrote to memory of 2460	2552	Unicorn-57442.exe	113
PID 2552 wrote to memory of 2460	2552	Unicorn-57442.exe	113
PID 1272 wrote to memory of 1504	1272	Unicorn-20254.exe	114
PID 1272 wrote to memory of 1504	1272	Unicorn-20254.exe	114
PID 1272 wrote to memory of 1504	1272	Unicorn-20254.exe	114
PID 2924 wrote to memory of 1992	2924	Unicorn-20617.exe	115
PID 2924 wrote to memory of 1992	2924	Unicorn-20617.exe	115
PID 2924 wrote to memory of 1992	2924	Unicorn-20617.exe	115
PID 1576 wrote to memory of 1012	1576	Unicorn-28531.exe	118
PID 1576 wrote to memory of 1012	1576	Unicorn-28531.exe	118
PID 1576 wrote to memory of 1012	1576	Unicorn-28531.exe	118
PID 928 wrote to memory of 4048	928	Unicorn-19599.exe	119
PID 928 wrote to memory of 4048	928	Unicorn-19599.exe	119
PID 928 wrote to memory of 4048	928	Unicorn-19599.exe	119
PID 2364 wrote to memory of 2696	2364	Unicorn-25730.exe	120

C:\Users\Admin\AppData\Local\Temp\585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe
"C:\Users\Admin\AppData\Local\Temp\585169a5537b2849744d49ef777cbb22b7f79858277167edce9551bb8dd02d3cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 720
        6⤵
        Program crash
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43229.exe
        9⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        9⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44313.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        8⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        8⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28966.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        7⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44989.exe
        7⤵
        
        PID:18372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48003.exe
        8⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32244.exe
        7⤵
        
        PID:18976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        7⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43051.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        7⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52236.exe
        7⤵
        
        PID:19276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        6⤵
        
        PID:18744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45709.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        8⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        8⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        8⤵
        
        PID:15800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15800 -s 444
        9⤵
        Program crash
        
        PID:18888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        7⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16798.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60857.exe
        7⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        7⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        7⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30720.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37915.exe
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52281.exe
        6⤵
        
        PID:18836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45086.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        6⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9631.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42480.exe
        5⤵
        
        PID:18544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27298.exe
        5⤵
        
        PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        6⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 404
        7⤵
        Program crash
        
        PID:5276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 408
        7⤵
        Program crash
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        7⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        6⤵
        
        PID:17972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33592.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10898.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4292.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        8⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-730.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2900.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31449.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        6⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25567.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29674.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16234.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        6⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29983.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        7⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6617.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6448.exe
        6⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15779.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55812.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40524.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25123.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8397.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42051.exe
        9⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29760.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        7⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        7⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24386.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38765.exe
        8⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11612.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        7⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8244.exe
        7⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        7⤵
        
        PID:19248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39600.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48734.exe
        6⤵
        
        PID:19296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55267.exe
        6⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2159.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54426.exe
        7⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25306.exe
        7⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47546.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        6⤵
        
        PID:18332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        6⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        6⤵
        
        PID:18248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        6⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        5⤵
        
        PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50670.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15361.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35371.exe
        7⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        7⤵
        
        PID:19204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11464.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24553.exe
        6⤵
        
        PID:17432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12626.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55320.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61407.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        6⤵
        
        PID:18132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21043.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
        5⤵
        
        PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25225.exe
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9483.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
      4⤵
      PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32384.exe
      4⤵
      PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10308.exe
      4⤵
      PID:18448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 724
        5⤵
        Program crash
        
        PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62050.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48750.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        8⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61660.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27977.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        7⤵
        
        PID:19204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59689.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        7⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        7⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43170.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10732.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19855.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        7⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49618.exe
        7⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        6⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21714.exe
        7⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28468.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52419.exe
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        6⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        6⤵
        
        PID:18784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21790.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63991.exe
        6⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58361.exe
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
        7⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        7⤵
        
        PID:18560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        7⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43166.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        6⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44318.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5787.exe
        6⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        6⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64629.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48400.exe
        6⤵
        
        PID:18992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49434.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        5⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        5⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        5⤵
        
        PID:18772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63817.exe
        5⤵
        
        PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28607.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7340.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9616.exe
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38180.exe
      4⤵
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15865.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8210.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61525.exe
        7⤵
        
        PID:18316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13054.exe
        7⤵
        
        PID:18340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48221.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47017.exe
        7⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        7⤵
        
        PID:18904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4814.exe
        7⤵
        
        PID:18720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
        6⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        7⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        7⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27892.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        6⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55252.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47726.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62156.exe
        5⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
        5⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        5⤵
        
        PID:18108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24355.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        7⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64348.exe
        7⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5711.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47525.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32585.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59455.exe
        5⤵
        
        PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34944.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46088.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19034.exe
        5⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10155.exe
        5⤵
        
        PID:18912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63747.exe
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
      4⤵
      PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
      4⤵
      PID:4212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2673.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45320.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        8⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53929.exe
        7⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        7⤵
        
        PID:18160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        7⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        6⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        5⤵
        
        PID:15352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        5⤵
        
        PID:19196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38288.exe
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17618.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24187.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40533.exe
        6⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        6⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        5⤵
        
        PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4768.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58771.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61633.exe
        5⤵
        
        PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63913.exe
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28868.exe
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
      4⤵
      PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18542.exe
      4⤵
      PID:19416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:19352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53466.exe
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
        5⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5423.exe
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51018.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      4⤵
      PID:6736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
    3⤵
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57722.exe
      4⤵
      PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        5⤵
        
        PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45495.exe
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18948.exe
      4⤵
      PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31682.exe
      4⤵
      PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28264.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25941.exe
      4⤵
      PID:14772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
      4⤵
      PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6920.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
    3⤵
    PID:12744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
    3⤵
    PID:15760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41010.exe
    3⤵
    PID:19040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64956.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        9⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50857.exe
        10⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        10⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        10⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        10⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15423.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        9⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        9⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        9⤵
        
        PID:19252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57228.exe
        8⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        8⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        8⤵
        
        PID:18536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32392.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15746.exe
        9⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        9⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        9⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        9⤵
        
        PID:19152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11832.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49382.exe
        8⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21753.exe
        8⤵
        
        PID:17416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16527.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37043.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
        8⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        8⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31817.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53394.exe
        7⤵
        
        PID:18668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26616.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13506.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41624.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35144.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32443.exe
        7⤵
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        6⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        6⤵
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60872.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35922.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43997.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47243.exe
        9⤵
        
        PID:19300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-558.exe
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61499.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        8⤵
        
        PID:18304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25294.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33139.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        7⤵
        
        PID:18956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59351.exe
        7⤵
        
        PID:18736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41511.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        8⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        8⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        8⤵
        
        PID:19180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58101.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        7⤵
        
        PID:18044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        7⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22879.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3934.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        6⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19931.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        7⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50757.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9938.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        6⤵
        
        PID:18344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8521.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18521.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9806.exe
        6⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30959.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11802.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51717.exe
        5⤵
        
        PID:19052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56271.exe
        5⤵
        
        PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11479.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15501.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12481.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        8⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        8⤵
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61059.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
        8⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28102.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        7⤵
        
        PID:18932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49964.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25017.exe
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17955.exe
        6⤵
        
        PID:19236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22300.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63773.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        8⤵
        
        PID:18772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63498.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        6⤵
        
        PID:18868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29839.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51194.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50830.exe
        5⤵
        
        PID:18500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46232.exe
        5⤵
        
        PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59111.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        7⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21696.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38868.exe
        6⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        6⤵
        
        PID:19264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29381.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52964.exe
        6⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34256.exe
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28868.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59442.exe
        5⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        5⤵
        
        PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27551.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5771.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48994.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24110.exe
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58703.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13654.exe
        6⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14570.exe
        6⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        5⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49961.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51159.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45346.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18027.exe
        8⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41458.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        7⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7177.exe
        7⤵
        
        PID:18160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50378.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1273.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
        6⤵
        
        PID:19312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62880.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30036.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23757.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4269.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        7⤵
        
        PID:19180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48837.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3955.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19893.exe
        7⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17669.exe
        6⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:18820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1225.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-922.exe
        6⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14951.exe
        5⤵
        
        PID:19320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9512.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54313.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35853.exe
        7⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        7⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47483.exe
        7⤵
        
        PID:18072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8158.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21003.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        6⤵
        
        PID:18624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33452.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48204.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54374.exe
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31838.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        5⤵
        
        PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3642.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
        6⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29130.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35925.exe
        7⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        6⤵
        
        PID:18296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21222.exe
        5⤵
        
        PID:18608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24858.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19726.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3164.exe
        6⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32852.exe
        6⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43707.exe
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
      4⤵
      PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
      4⤵
      PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10483.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4956.exe
        5⤵
        Executes dropped EXE
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16078.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48361.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        7⤵
        
        PID:19336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31668.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
        6⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14494.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57598.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        7⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        7⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37705.exe
        6⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49413.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        5⤵
        
        PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46544.exe
      4⤵
      Executes dropped EXE
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34552.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22269.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36851.exe
        6⤵
        
        PID:16212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16212 -s 404
        7⤵
        Program crash
        
        PID:16952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16212 -s 408
        7⤵
        Program crash
        
        PID:18756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65308.exe
        6⤵
        
        PID:18916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:19340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16239.exe
        5⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42184.exe
        5⤵
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        5⤵
        
        PID:18460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14619.exe
        5⤵
        
        PID:19144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8593.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49431.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12488.exe
      4⤵
      PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34686.exe
      4⤵
      PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31650.exe
      4⤵
      PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
      4⤵
      PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54754.exe
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43534.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46423.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        5⤵
        
        PID:19444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        5⤵
        
        PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        5⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28384.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6451.exe
      4⤵
      PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52782.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
      4⤵
      PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40149.exe
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      4⤵
      PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
    3⤵
    PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59763.exe
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
    3⤵
    PID:5252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42267.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42267.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21833.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61656.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2206.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14758.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        8⤵
        
        PID:19188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29730.exe
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        7⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55687.exe
        7⤵
        
        PID:18064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24922.exe
        7⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51417.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23001.exe
        7⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47249.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15475.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
        6⤵
        
        PID:19304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53986.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49705.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65413.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18707.exe
        7⤵
        
        PID:19192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23700.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28852.exe
        6⤵
        
        PID:18580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39120.exe
        6⤵
        
        PID:18904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        6⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48336.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15651.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36482.exe
        5⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8589.exe
        5⤵
        
        PID:18036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62033.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17635.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59632.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23141.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10179.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        5⤵
        
        PID:18704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41842.exe
        5⤵
        
        PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46613.exe
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2745.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23804.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38745.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40364.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7067.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34313.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62792.exe
        6⤵
        
        PID:18624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8634.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        5⤵
        
        PID:17656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53374.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29514.exe
        6⤵
        
        PID:18804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23865.exe
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11120.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30912.exe
        5⤵
        
        PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18324.exe
      4⤵
      PID:11104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55807.exe
      4⤵
      PID:14384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
      4⤵
      PID:17928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14790.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5271.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6617.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
        5⤵
        
        PID:18716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        5⤵
        
        PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17997.exe
      4⤵
      PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58528.exe
      4⤵
      PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15908.exe
      4⤵
      PID:18440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
      4⤵
      PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
    3⤵
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25430.exe
        5⤵
        
        PID:19212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        5⤵
        
        PID:18920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58895.exe
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23808.exe
      4⤵
      PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
      4⤵
      PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      4⤵
      PID:18688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
      4⤵
      PID:19304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
    3⤵
    PID:7860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
    3⤵
    PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11054.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44097.exe
      4⤵
      PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54958.exe
    3⤵
    PID:10336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
    3⤵
    PID:12736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 540
    3⤵
    - Program crash
    PID:3960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44391.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28626.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33992.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        7⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45247.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31807.exe
        6⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        5⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2393.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        6⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46039.exe
        6⤵
        
        PID:17924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23893.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24384.exe
        5⤵
        
        PID:17712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
      4⤵
      PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        5⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63226.exe
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22579.exe
    3⤵
    PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34334.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        5⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        5⤵
        
        PID:18944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
      4⤵
      PID:17152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
      4⤵
      PID:19428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
      4⤵
      PID:8024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49008.exe
    3⤵
    PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
      4⤵
      PID:14584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
      4⤵
      PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      4⤵
      PID:656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34832.exe
    3⤵
    PID:9224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
    3⤵
    PID:12652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
    3⤵
    PID:15412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
    3⤵
    PID:18528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
    3⤵
    PID:8920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
    3⤵
    PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62445.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32195.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48177.exe
        5⤵
        
        PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46835.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
      4⤵
      PID:12660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15531.exe
      4⤵
      PID:18816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
      4⤵
      PID:17904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
    3⤵
    PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30831.exe
    3⤵
    PID:8984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
    3⤵
    PID:14080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1326.exe
    3⤵
    PID:19384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
    3⤵
    PID:18628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
  2⤵
  PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    3⤵
    PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
      4⤵
      PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
      4⤵
      PID:12492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25046.exe
      4⤵
      PID:6896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14655.exe
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54069.exe
    3⤵
    PID:12332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58912.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:17192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
    3⤵
    PID:19436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34252.exe
  2⤵
  PID:6920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50211.exe
  2⤵
  PID:12632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53581.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-744.exe
  2⤵
  PID:18824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:8
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 4540
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1572 -ip 1572
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2772 -ip 2772
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3652 -ip 3652
1⤵
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3652 -ip 3652
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 16212 -ip 16212
1⤵
PID:17252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 16052 -ip 16052
1⤵
PID:18876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 16212 -ip 16212
1⤵
PID:18632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10519.exe

Filesize
184KB

MD5
9f6465be90e5051d848edf08e7499045

SHA1
f13277221b7d6279a7ad7c179c5b804efbb3e212

SHA256
8014b2e1af859894e38b47efbcfa44c1a554b6a073ce9da16e2741339d919c67

SHA512
e6373b89eddddd45d6d088bb57cc81a3487619dd9789a85e08e48725e50b2932c6d244f5d2f049fbd0c1ef90d1153f622817258bf97dfe7c6f51856da45ffbf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe

Filesize
184KB

MD5
995571d56ea08acb12cfc72370a9fca7

SHA1
92953c9984c057cb1b151eaeb692314869ef92df

SHA256
921ecd4b159c9a9ccb5981f9301f012ff9abbfd6b3de6d95479a18e27aa2b0af

SHA512
0d7c3fe17e4504172d6a07618ed0376afe36f1165594c294b8335adc394e79e50273a80a1eba0c9b927a8d5d9581c693ac6d13c28f3601a2738ea4a58ec6b3e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe

Filesize
184KB

MD5
4074e3ea18caf5e9c02269d0f2c6e20b

SHA1
bfe4842333cb3448ab3941a75d868659bf9a085b

SHA256
30bc728f2a4f4e4027184444809c8ad7d299cb0276e3c316e9b363d5f8c2de64

SHA512
321a1885d9f95a34ebca9c43c2da2430c773e2a560e167ed84fd9c9ae2730034cfb30ca55b75e252d903e4b3bf539631a296982d703d460f04f80e8b20cdc47e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14546.exe

Filesize
184KB

MD5
8e1e1e65abe0b52b96fd7caa29365903

SHA1
e6892626493bb427cdd979583e028b52b589a966

SHA256
34cadae92c13f96925b2e24d41a1e98def6e6fa2aa6e405cd24e2c520110244a

SHA512
c596b9609fc9340627426bb5028c84b2249bb78d1b833a86d4104fa4eeaf48cc99181213beaddbd39d1c41035135e74f372bcc20d107dadd33711806d6a28edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe

Filesize
184KB

MD5
6e82aec9d4e90f82f642c0df8e9efb34

SHA1
4c3e27c3e00c361969faeb78992df3a4c56be1ac

SHA256
5d2f39c36172e13402bdc88bb1fe1837d075b46d8c318e036845db15f938a0af

SHA512
213395c6e05fdfb0cf3e4859855285221286d4e1257234f752782a6930e2ba1d5fca2a2534d235d7959bd0820c1719532d74478e196fff61125fb300f23bd703

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe

Filesize
184KB

MD5
597ce6efd0c7e13d74b2e2f6afe6856b

SHA1
0da26c9aefb8dc6235591a5861b59e936a18a797

SHA256
ed4d24c39ad618883699f0401dc044b3b9775abc9953ef408b0c8a9695359147

SHA512
d0cef558414ab6df22582bb03e14be9c6cf3ad5c7c0e8083cf08cbdf674134169043d0da73828070716766c90498e85ba14494dcb0499315f655f7e689860bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe

Filesize
184KB

MD5
3ff39b61049843a2b15a286cf8c0c94c

SHA1
b084c3b4d8399dafa2e5faaa4fb237b10b29f4c0

SHA256
72ed52966f918e783738b4f39f82024974e49e4fce210ff4f5877f1d9f68158b

SHA512
16cfa4a5684bfaff2d8125950c52c6529edb6ce2ae85a8b109e18f126de66b8654fa5bc8b0818d1dede19608d20a17776eb8e1334b4db5df1479dcf8da0a0c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe

Filesize
184KB

MD5
760e73900818dd9beea222f3fc6a767c

SHA1
469303ab642d00c70daa7ea2249613066c4413f5

SHA256
d1d94e6bc0e3760c162a7790cea77b51a3b64f533149e714b8a0fa1fbe7a5670

SHA512
424d662544dd460ac70d4688ee90d8702151597ce4469f95813b91e15770f76bb5abafc272959fdcb1c856748cd304399eac25656c77afc7df51b3f68fcc411c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20254.exe

Filesize
184KB

MD5
ac33ed7c8650ba5813397cd660e9b2a9

SHA1
fce1882a6e45765197d908819d1ceff1f97c0039

SHA256
81f6cc8521e195002e8e36ac0e7cf4c8a30e284d891d894057cc94a76829b5e7

SHA512
347d25378e209fbca8e1018eb9cac2b5bcda4245cf8549b122017069db8ff8e680edb3ebb3cd1685e4dd9c31f4dddab2c1a990d6add2c9d86aea1f8e9956faf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20617.exe

Filesize
184KB

MD5
04d7f873b4f7a823929451ec3c756842

SHA1
9be2476d71b6f03d21381607a17374b5b2ccf725

SHA256
927aee677e4054150a559d67fc030613b56d81f9e83c642bad1118c303492922

SHA512
bf964b1e32b2b58a9fe87d75c27a51055aaf3dc18ce8c9cdc4013fb74a9f206bf98fe3829c08e61376637264a84df258058c538176735641e55ab05a1e0f3957

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe

Filesize
184KB

MD5
4786897b4fdc5c540afbcc14851cd8f2

SHA1
d3575f18cc21f5018b0b14374efe9dac60454ac6

SHA256
b338443df8b5b39aec35f59dc2ea63b3aa8f2f60e9a5f0ad67bb6d197136962d

SHA512
22a733adfa0363fa105d51e5abbbc67492a0faf56a5afa969f685bc5111ed5127a3d4e6f60c59b830c8f9004faafab8e1403f89c8415462ae784eed276d30ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe

Filesize
184KB

MD5
585be01b62a565131985bf7788c2662d

SHA1
770a07186432379ef241aee7ae58dfd00497b6c6

SHA256
927f222038c5f4f8752c82a2e472a1b5c2efc042bac653ac0464dd26193b41d3

SHA512
97fcbc0b365e8200c1b0125f1d8723242b5f954920ad1b941e609e86bf74a95e93946d640bb887000191504f6096962a75f6cc2bf686cc7d1e440d99fccca846

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25704.exe

Filesize
184KB

MD5
599ecdc903c372dc17a85ca4c8b88bab

SHA1
35ee41da3f2580776eb44514335796c5ddf56249

SHA256
7e2f95b976b018e27cdda643463f2f5856021ba8bcba0d59b7b3aaadad74e879

SHA512
3fc09c975700c20c707a2628a2dee15a958c39dfa0a67464edd1d9c589ad75818aac81d727c537fdaeb9e0a8ac4eddbde8320ffd779be907463764d8da222daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25730.exe

Filesize
184KB

MD5
6082e31e46ad434f4abf73729786b4dd

SHA1
03aa62a2c73da8495a16bad7bfa672ccacf99fb2

SHA256
55c1534607dbba3755b21a8d393eaee53ca8246009c4998a203f7920126016bd

SHA512
1aefb31631a546136dac2891737313c2a2d1f899a1b9248c0f8b1efa0225e9cb0a4ef3865ef5cd333812d8cbce1effe16fae7fdc99513e934436bd24bb731fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe

Filesize
184KB

MD5
44c8da4ba9758c1bb24894241764089c

SHA1
9888e218a11f3556e69a53bd617a5db7c33816b5

SHA256
6828a5db401b98771d795eb287346a9a51ebe876b8f28e36acdef3faf70459ad

SHA512
c98de99bb1aa4752ebda8a43fa1a4c76bd22f8266caf1a5b7dd049c63b82fb4e5f6edf09498790984484169c8683c7da60331e5863677c04ba4b477b847f8f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe

Filesize
184KB

MD5
764ebe0d06813e80b8ca0e45ec3cc391

SHA1
5e8c7f1fd5526fe55399f715021a1707ff066d99

SHA256
538386e27c96ec269877a48bf8b94c478146c3df751b8735e76a4e048725272f

SHA512
de3e14d624629f4d4b6d8bc91c36eea480b25a7594ae393d9252f2d737288736f6cadc5b865398966feeb9271f5b9bd59678f957ad3ae9b199db7d27ba0ffc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28531.exe

Filesize
184KB

MD5
4cd4289cd8cfd97acb2692b21ff893be

SHA1
a1424013a2b71239735d9603ced0be72483e8e7f

SHA256
2cbfd9dcbe909d9826fc4eaa77ae44ea768bd25fe00835a3a40b9ed13407da9f

SHA512
f191b9ed6da2aab75e9d6104bdd436955253bebb188b13e23ea64e4f09aea33640990b5826546489607325d6ee18fd9af95a02fd9d5880b35ee9a8d7c616d9ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe

Filesize
184KB

MD5
925389d8aa1e8584a94d8d25d98ddfb8

SHA1
b94460b0e1bb171cc705be93b4de12e0534a9bee

SHA256
f1942ac97d8112ddcf6bc9762d35a54abf99ae1e8d063adfa118c3c880150a31

SHA512
6080a0e3dd2554613ef6015bc63cd031b2efbfdfc8b7d0fe89601904c1f2a5a20b6d9940de3ef3d41c37eef6376ee6047a5fcc9f96248c653c3597cd3c364c5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe

Filesize
184KB

MD5
a2fc3e6e1e9bbec1b812f610e267a3d6

SHA1
30b0f25fda1180fce4022f79bdc2195b53aa8900

SHA256
4e355b1b97d54a6677ffc8525d5636509485a3e7612731fc762246b77d81771c

SHA512
34b19132eea163fe794e8a9153995d9ae528e4061fa9f9469a6af6cc36f1a5c00ace2d710462bf4d0b993ae586b1d1f99435eb7c305b2f0fdf3da39ca74a4040

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe

Filesize
184KB

MD5
af277be65b6a7d62c05c9dc2502b7db7

SHA1
2d1f28fbb23fd67a00d2fdda9188271dde8ff312

SHA256
eb3f382b17f1067e93e9575b76c8f1486e5270e2be46f00eb4e2c9362d0964ee

SHA512
750eeaa8e892447a86f4eb540784b5d65d23ea1abf10cef09efb7cbbadc402c36f97c2fa5b554fb9aa4c1d5a3e1ce3fc36612b4275c3c227c3dadc1fa247ccb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40648.exe

Filesize
184KB

MD5
77e1ac04140ebf8d9a3b696c3375d459

SHA1
5d534826a9cf10cc17f59f0871a0add8cdd9c127

SHA256
716035045460041ad6a571ee3246bfb7e41923182597bf0e33f7199fd43dc8df

SHA512
b13d906bc653b8b3783dd8bf356a463a957bd920468a84dc0d81d304c3136f8cdaf20ad729f4982a2b5a79ddfe6c951fc3164bcf971e1155624cc55d84a3968f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41277.exe

Filesize
184KB

MD5
72e72d49f57ab18b0e9048b3dea739d0

SHA1
ddb2520f72f8f011ca05d70efcb67a3b0ef2784f

SHA256
ba7b4eccc345fbfa01a8e29e7720688e8ba53c63720cf68e0fdfb02c984200d3

SHA512
4f58686892496019a19aac76abc5e0d7e64dcdb33b97d67ddee97b5032adfff17a43df19d17a7e34997f0b17afc79d7c97690d13de5b6b8d1e53d40cb7c9eb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42267.exe

Filesize
184KB

MD5
f0c318f1d24fc145ac5bde6a2022b06a

SHA1
cfc2808362d73d6afe9b34fa70739bf363f59809

SHA256
72682589e630559c1138f655ebab6d2d4bd15d67834e899bc37a6ad5301ca348

SHA512
2e52c8a49980f032a116faeda7de95bbfadd9a120016e7c6a2e658ea253593a24e306314103e520694be32f17851d3609cfecdc5ebb0db2b644cc3630fd64904

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe

Filesize
184KB

MD5
2b2c8505bc089081b41a81bbbdf24aae

SHA1
21a3b26232412e9f5951d9e5dbf026a87506ad89

SHA256
6ae17b0cd8859de8e952cccd5b92a65603010bcd2996aa2b0f26bed2bca0d486

SHA512
ba31b0ff2e60f5f374e109c30cf89c258bfe23c186e9e0b2b649da98d5d9003a94df214c159466e26dd190cbd4c9f8e0661764874e066d98b0a4f1c7298cf5fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe

Filesize
184KB

MD5
bfc2eba42704d0eead8830b1cccb2b44

SHA1
8df59b35e1cdf4205634962ac1309908eab64a1f

SHA256
618a27b804cf41e134f5d0f8d772db6f5394b138c93fe42d085ebc45541608fa

SHA512
edfe8d176332621dd1c6a351f4f34c1d9c2be7150622b4ce71045c1f64a59de03182b6a605b9f7c30ea356fdbb5decde082350b4a90eb30325d4beb28b856a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4701.exe

Filesize
184KB

MD5
16456e02af6516c9903776cf978cb307

SHA1
6d8665e8193f7fc399bee5402de1f04de1684462

SHA256
ef594e103e961500436d0af025081381dff0329b2c2fc6361e5c85dde3673156

SHA512
c3751e3cd2294b29b8a12fbe53af64e808ff7e8e397e1f4ec6c4af5f5b393547b17bf7db51d73f052f73ce42e9c830b0e28aa579985f509be75b256f0a2cf155

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe

Filesize
184KB

MD5
3ae6e74a3ad236e77543d0bd75493fcc

SHA1
f1f9d2a94ef69c31866ba451d55839588b2a61d5

SHA256
d5412c2d7321266638e4a2bfd587226f99a3a2e465b4f77a675f514f31ebf820

SHA512
fa64e4daf19929d2cc3200a2df1c0396543c607c8aa7f137c928db95621093edcdc10c2d33ebf817226cafafc82155b1264ff20e5bc2cc211b624a078c83f65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48994.exe

Filesize
184KB

MD5
3f2a24692796e2ea8a5f11112d807fa6

SHA1
83299b46f0bed4b212a10db176eb94dccfae0bf9

SHA256
fe2b899f016764bc3135f417909b755c44b9a60c5199407fc98ca9fc252b1498

SHA512
f095484812acf2bcd5981ac4418d6d9f2f9845d1f014eb1165d52bae7a6641bec321ac57d785b73bad77381362af24f1083f7659e01c878642586987c85b249e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe

Filesize
184KB

MD5
c27aac07aa30e33b5a6635e9b25e63d1

SHA1
ad3ea25d8fd3f2deb9eb4804d1de8e5597e22a9f

SHA256
c830c78fd6f02aa423936a82340e5a4bb218455086d9eb28eace6757e524d357

SHA512
9a087d03cdea0836d5a62ae552c202c22cb0c30efa883561a6d6ad60fa82d5a46342ef09f499ec4af817390d24a320ffd647c39bf7530de5b829de4282da2fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53415.exe

Filesize
184KB

MD5
b40eb469d1ce5c2a79d64ddf35495f47

SHA1
d88b51e224abc5bab9682a42f2f515c029a5e89a

SHA256
c0983daddcbc0b6639c2e8f3c39ca6313ebca5413253f40d5c1e7885bf22087b

SHA512
0763f9aa194402b9a92ebcbb9c4d2af5357e174120abada8447e80a649fc9d0f3d48b84f32e473701cac7679ac5973752bba7910111d21d5cc363b0c1e192276

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe

Filesize
184KB

MD5
c45a6486837ee2e74b7f0c9c23af8605

SHA1
506b33294b544353555977a7620d01cea1d18aa5

SHA256
355c98f2f38eb6198e209b91e208b83c96f848bd7a0fcb2f6a5643a34773c5da

SHA512
2817c192d976c2a33e027c9b5ab47be5b9053b7db3eec2ead36b265682cea305bccfb52d7977f9f45536804f30bd70c90dba68cfefe420325f698b9951237539

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe

Filesize
184KB

MD5
dfa483173906162a8907b3cdf5d65323

SHA1
58b346d304d24ee0230eb891db1e4b1dfa521861

SHA256
9b2e059f174660f9133ff74d036dd4ab57da4c7eae03b8105f72b259ace8f203

SHA512
38a290a6336a76176a371a2f2c85931f6810a20267a870b3159062f8524a1010a72f9aa744db0baaf354355a139c3aae7e139a71f3e8e785ebd72c38cefee703

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe

Filesize
184KB

MD5
547e8b2a3bdfe2673e0ee810379ecd2e

SHA1
6769ac72c1bf9693d0f30aa107fdfef0470b22a5

SHA256
ab6be77c4dfdc6711c7abe5733dcd8554e774237ffe2a68eab094a93c70b144e

SHA512
632b42319ee0894989fcaf5668778918e9dab3db92f58e86e1523ceb2fb12ce84b52f55262b02b2801e67feca7e9b20d2063a3d6827f9754d5e42e8d099b565f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5864.exe

Filesize
184KB

MD5
2a1bc0731d10d87a7a64551953986943

SHA1
26ab0a33d15c714ed9776a59c61001f69ed29a2c

SHA256
f363641babf8558eb1d4ffb55a287e2faf7181184f9a091186a78d1f3c8e2cd6

SHA512
e4a4a4a86dad8c1e51df2a12299918fa7d55243436d3673fb4bfbb9487c017e70bb2d3751c1f7e5de929967180b1c726e9fea296ad8156e5ebdef34003d8a4a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe

Filesize
184KB

MD5
dfb81a7a48afe9f322a03a7f8e82bd51

SHA1
b3524dfb6d923dac3b9b55759080a9e03d9dda10

SHA256
55e3e6f6144bf26ab9631ab779ff4a2dc84d32c3fe74dd189f23302b49161627

SHA512
73741511cac7b0cc1a6d5245ce1bf0e2a27ceca4e03c7c058ef721af3ce0c526d6f5205a0e999d8a5670d62c7b860ee8167d1181563b28702c5bf49aa24e2b5a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads