aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57

Analysis

max time kernel
117s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe
Size

468KB
MD5

5f36ce5b868ef1049312c3b19ee14720
SHA1

3f61a855c57dfa0688db0399395fef8bdf3befdc
SHA256

aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57
SHA512

09c8f8aeb106fd3c06e19c0d1baabad07fffaa3d690f774e87e587256b9ad933a9224033dab2c725bc9d64d0ec082d1d34a119b31f76aca8a5e5b52eb40e1eb1
SSDEEP

3072:KbZ2ogHdIf5JsrYJ/ztkcf8/ECbCPI4wnmHemEh8o4H88lwuk5l8:Kb4oXBJs+/JkcfBdK+o4c4wuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1148	Unicorn-60133.exe
3696	Unicorn-11620.exe
2980	Unicorn-24619.exe
3224	Unicorn-46120.exe
1944	Unicorn-30853.exe
4192	Unicorn-23845.exe
3656	Unicorn-10110.exe
4440	Unicorn-27013.exe
2284	Unicorn-5886.exe
4552	Unicorn-29509.exe
3792	Unicorn-12596.exe
4796	Unicorn-12596.exe
2216	Unicorn-9067.exe
1592	Unicorn-27791.exe
5016	Unicorn-21925.exe
4896	Unicorn-10391.exe
4404	Unicorn-57132.exe
1628	Unicorn-29909.exe
1292	Unicorn-6565.exe
2392	Unicorn-30677.exe
2232	Unicorn-59135.exe
5112	Unicorn-16152.exe
5108	Unicorn-62892.exe
2172	Unicorn-17221.exe
812	Unicorn-31912.exe
4924	Unicorn-16379.exe
688	Unicorn-16645.exe
2936	Unicorn-15768.exe
2364	Unicorn-62508.exe
3436	Unicorn-7906.exe
388	Unicorn-10706.exe
3172	Unicorn-26069.exe
5052	Unicorn-8855.exe
4708	Unicorn-55596.exe
2464	Unicorn-3794.exe
4860	Unicorn-15399.exe
3752	Unicorn-45996.exe
3396	Unicorn-324.exe
3572	Unicorn-65020.exe
2652	Unicorn-50101.exe
4780	Unicorn-50101.exe
4624	Unicorn-61455.exe
1976	Unicorn-18389.exe
4524	Unicorn-61459.exe
3816	Unicorn-50412.exe
3412	Unicorn-4356.exe
4864	Unicorn-47043.exe
3664	Unicorn-3588.exe
1632	Unicorn-19749.exe
2352	Unicorn-10228.exe
1576	Unicorn-41256.exe
3824	Unicorn-41256.exe
2240	Unicorn-25989.exe
1328	Unicorn-54940.exe
2496	Unicorn-40607.exe
2500	Unicorn-139.exe
3940	Unicorn-58469.exe
2528	Unicorn-8427.exe
4612	Unicorn-38603.exe
3996	Unicorn-58469.exe
1332	Unicorn-8427.exe
1728	Unicorn-19362.exe
2160	Unicorn-12532.exe
4752	Unicorn-46632.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
4568	4552	WerFault.exe	98
6412	6008	WerFault.exe	233
5784	4552	WerFault.exe	98
6436	2392	WerFault.exe	108
7364	4624	WerFault.exe	130
6344	6008	WerFault.exe	233
7072	2392	WerFault.exe	108
7844	1136	WerFault.exe	171
7844	8756	WerFault.exe	393
8364	4624	WerFault.exe	130
6472	1136	WerFault.exe	171
3168	5716	WerFault.exe	239
9960	5832	WerFault.exe	214
13020	5832	WerFault.exe	214
5060	7948	WerFault.exe	349
17204	7948	WerFault.exe	349

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59135.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2590.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
944	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4244	dwm.exe
Token: SeChangeNotifyPrivilege	4244	dwm.exe
Token: 33	4244	dwm.exe
Token: SeIncBasePriorityPrivilege	4244	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe
1148	Unicorn-60133.exe
3696	Unicorn-11620.exe
2980	Unicorn-24619.exe
3224	Unicorn-46120.exe
1944	Unicorn-30853.exe
4192	Unicorn-23845.exe
3656	Unicorn-10110.exe
4440	Unicorn-27013.exe
2284	Unicorn-5886.exe
4552	Unicorn-29509.exe
3792	Unicorn-12596.exe
4796	Unicorn-12596.exe
1592	Unicorn-27791.exe
2216	Unicorn-9067.exe
5016	Unicorn-21925.exe
4896	Unicorn-10391.exe
4404	Unicorn-57132.exe
1628	Unicorn-29909.exe
1292	Unicorn-6565.exe
2392	Unicorn-30677.exe
2232	Unicorn-59135.exe
5112	Unicorn-16152.exe
688	Unicorn-16645.exe
5108	Unicorn-62892.exe
4924	Unicorn-16379.exe
2936	Unicorn-15768.exe
812	Unicorn-31912.exe
2364	Unicorn-62508.exe
2172	Unicorn-17221.exe
3436	Unicorn-7906.exe
388	Unicorn-10706.exe
3172	Unicorn-26069.exe
5052	Unicorn-8855.exe
4708	Unicorn-55596.exe
2464	Unicorn-3794.exe
4860	Unicorn-15399.exe
3396	Unicorn-324.exe
3752	Unicorn-45996.exe
3572	Unicorn-65020.exe
4780	Unicorn-50101.exe
2652	Unicorn-50101.exe
4624	Unicorn-61455.exe
1976	Unicorn-18389.exe
4524	Unicorn-61459.exe
3816	Unicorn-50412.exe
3412	Unicorn-4356.exe
4864	Unicorn-47043.exe
3664	Unicorn-3588.exe
1632	Unicorn-19749.exe
2240	Unicorn-25989.exe
2352	Unicorn-10228.exe
3824	Unicorn-41256.exe
1576	Unicorn-41256.exe
1328	Unicorn-54940.exe
2500	Unicorn-139.exe
2496	Unicorn-40607.exe
3940	Unicorn-58469.exe
2528	Unicorn-8427.exe
4612	Unicorn-38603.exe
3996	Unicorn-58469.exe
1728	Unicorn-19362.exe
1332	Unicorn-8427.exe
2160	Unicorn-12532.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1148	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	86
PID 740 wrote to memory of 1148	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	86
PID 740 wrote to memory of 1148	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	86
PID 1148 wrote to memory of 3696	1148	Unicorn-60133.exe	88
PID 1148 wrote to memory of 3696	1148	Unicorn-60133.exe	88
PID 1148 wrote to memory of 3696	1148	Unicorn-60133.exe	88
PID 740 wrote to memory of 2980	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	89
PID 740 wrote to memory of 2980	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	89
PID 740 wrote to memory of 2980	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	89
PID 3696 wrote to memory of 3224	3696	Unicorn-11620.exe	92
PID 3696 wrote to memory of 3224	3696	Unicorn-11620.exe	92
PID 3696 wrote to memory of 3224	3696	Unicorn-11620.exe	92
PID 2980 wrote to memory of 1944	2980	Unicorn-24619.exe	93
PID 2980 wrote to memory of 1944	2980	Unicorn-24619.exe	93
PID 2980 wrote to memory of 1944	2980	Unicorn-24619.exe	93
PID 740 wrote to memory of 4192	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	94
PID 740 wrote to memory of 4192	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	94
PID 740 wrote to memory of 4192	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	94
PID 1148 wrote to memory of 3656	1148	Unicorn-60133.exe	95
PID 1148 wrote to memory of 3656	1148	Unicorn-60133.exe	95
PID 1148 wrote to memory of 3656	1148	Unicorn-60133.exe	95
PID 3224 wrote to memory of 4440	3224	Unicorn-46120.exe	96
PID 3224 wrote to memory of 4440	3224	Unicorn-46120.exe	96
PID 3224 wrote to memory of 4440	3224	Unicorn-46120.exe	96
PID 3696 wrote to memory of 2284	3696	Unicorn-11620.exe	97
PID 3696 wrote to memory of 2284	3696	Unicorn-11620.exe	97
PID 3696 wrote to memory of 2284	3696	Unicorn-11620.exe	97
PID 1944 wrote to memory of 4552	1944	Unicorn-30853.exe	98
PID 1944 wrote to memory of 4552	1944	Unicorn-30853.exe	98
PID 1944 wrote to memory of 4552	1944	Unicorn-30853.exe	98
PID 4192 wrote to memory of 3792	4192	Unicorn-23845.exe	100
PID 4192 wrote to memory of 3792	4192	Unicorn-23845.exe	100
PID 4192 wrote to memory of 3792	4192	Unicorn-23845.exe	100
PID 3656 wrote to memory of 4796	3656	Unicorn-10110.exe	99
PID 3656 wrote to memory of 4796	3656	Unicorn-10110.exe	99
PID 3656 wrote to memory of 4796	3656	Unicorn-10110.exe	99
PID 2980 wrote to memory of 2216	2980	Unicorn-24619.exe	101
PID 2980 wrote to memory of 2216	2980	Unicorn-24619.exe	101
PID 2980 wrote to memory of 2216	2980	Unicorn-24619.exe	101
PID 740 wrote to memory of 1592	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	103
PID 740 wrote to memory of 1592	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	103
PID 740 wrote to memory of 1592	740	aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe	103
PID 1148 wrote to memory of 5016	1148	Unicorn-60133.exe	102
PID 1148 wrote to memory of 5016	1148	Unicorn-60133.exe	102
PID 1148 wrote to memory of 5016	1148	Unicorn-60133.exe	102
PID 4440 wrote to memory of 4896	4440	Unicorn-27013.exe	104
PID 4440 wrote to memory of 4896	4440	Unicorn-27013.exe	104
PID 4440 wrote to memory of 4896	4440	Unicorn-27013.exe	104
PID 3224 wrote to memory of 4404	3224	Unicorn-46120.exe	105
PID 3224 wrote to memory of 4404	3224	Unicorn-46120.exe	105
PID 3224 wrote to memory of 4404	3224	Unicorn-46120.exe	105
PID 2284 wrote to memory of 1628	2284	Unicorn-5886.exe	106
PID 2284 wrote to memory of 1628	2284	Unicorn-5886.exe	106
PID 2284 wrote to memory of 1628	2284	Unicorn-5886.exe	106
PID 3696 wrote to memory of 1292	3696	Unicorn-11620.exe	107
PID 3696 wrote to memory of 1292	3696	Unicorn-11620.exe	107
PID 3696 wrote to memory of 1292	3696	Unicorn-11620.exe	107
PID 4552 wrote to memory of 2392	4552	Unicorn-29509.exe	108
PID 4552 wrote to memory of 2392	4552	Unicorn-29509.exe	108
PID 4552 wrote to memory of 2392	4552	Unicorn-29509.exe	108
PID 1944 wrote to memory of 2232	1944	Unicorn-30853.exe	109
PID 1944 wrote to memory of 2232	1944	Unicorn-30853.exe	109
PID 1944 wrote to memory of 2232	1944	Unicorn-30853.exe	109
PID 4796 wrote to memory of 5112	4796	Unicorn-12596.exe	110

C:\Users\Admin\AppData\Local\Temp\aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe
"C:\Users\Admin\AppData\Local\Temp\aca3aff68838c4433d80f4097c3e198f60f00e60086972cbb0ae5a57d85c5c57N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        10⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        11⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        11⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        11⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        10⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        10⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        10⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        10⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37579.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        9⤵
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63980.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        9⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        10⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        10⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        10⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        9⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        9⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        9⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        9⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47394.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17816.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3844.exe
        9⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        9⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        9⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61203.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6916.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        9⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30970.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28235.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32741.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        9⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18353.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40970.exe
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18615.exe
        8⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51987.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        8⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        8⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55116.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        7⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56947.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11988.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10131.exe
        9⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        8⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        7⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8651.exe
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57755.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37876.exe
        6⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18901.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        9⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        9⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        9⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        8⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        8⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44671.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9914.exe
        8⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        8⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37907.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13962.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        7⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49307.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59740.exe
        6⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19797.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
        9⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        9⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2059.exe
        8⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
        7⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        7⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
        6⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45210.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30981.exe
        6⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9751.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9511.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        8⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44018.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49643.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40062.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        7⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39131.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64242.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16059.exe
        6⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45599.exe
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1723.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21733.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51435.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        7⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64694.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61768.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13027.exe
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56335.exe
        7⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18170.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        6⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25737.exe
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15399.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46632.exe
        7⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32725.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62453.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        10⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31879.exe
        10⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        10⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        9⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53740.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
        8⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13252.exe
        8⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55643.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46738.exe
        7⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51612.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
        6⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        9⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36066.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14235.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29012.exe
        8⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48319.exe
        8⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
        7⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62994.exe
        7⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9246.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2593.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25594.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52341.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        8⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3281.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
        7⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        7⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9082.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50904.exe
        6⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        7⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61967.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        6⤵
        
        PID:13160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19922.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36234.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64772.exe
        5⤵
        
        PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
        5⤵
        
        PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30789.exe
        6⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9803.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3770.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23371.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        6⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        6⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42996.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20810.exe
        5⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65020.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29720.exe
        5⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14369.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8465.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55403.exe
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        6⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        6⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        5⤵
        
        PID:8756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8756 -s 472
        6⤵
        Program crash
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7940.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26459.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
      4⤵
      PID:6008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 464
        5⤵
        Program crash
        
        PID:6412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 504
        5⤵
        Program crash
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
      4⤵
      PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5812.exe
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
        9⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5379.exe
        10⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
        10⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        9⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        9⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        9⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
        9⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        8⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        8⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        8⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54694.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51676.exe
        6⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60824.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-890.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51644.exe
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46241.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57570.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50412.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
        6⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        8⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        8⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        7⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8673.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        7⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2418.exe
        7⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33298.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8202.exe
        6⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        5⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5927.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        7⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47768.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57980.exe
        6⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        5⤵
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58200.exe
        5⤵
        
        PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3588.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22040.exe
        6⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28901.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17435.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4874.exe
        7⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37758.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        7⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18747.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        5⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        7⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24232.exe
        6⤵
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        6⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60643.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39642.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19749.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
        5⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        7⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47662.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29471.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16213.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45484.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        5⤵
        
        PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41699.exe
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
      4⤵
      PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
      4⤵
      PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        8⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62306.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        7⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        7⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        6⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23861.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25308.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        6⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        6⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58930.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        5⤵
        
        PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51240.exe
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        7⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-306.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36970.exe
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        6⤵
        
        PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2058.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25682.exe
        5⤵
        
        PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28898.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56472.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        5⤵
        
        PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        5⤵
        
        PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53052.exe
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3140.exe
      4⤵
      PID:6976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        7⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65122.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64198.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53010.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        6⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17154.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8394.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30155.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28380.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      4⤵
      PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
      4⤵
      PID:15156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29013.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3771.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64523.exe
      4⤵
      PID:14304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8494.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9219.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46571.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50267.exe
      4⤵
      PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
      4⤵
      PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65205.exe
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
    3⤵
    PID:11836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
    3⤵
    PID:15392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24619.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10135.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4503.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
        10⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50027.exe
        10⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        9⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12606.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46955.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63429.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48002.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36931.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45986.exe
        7⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65324.exe
        6⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51957.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
        8⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15204.exe
        9⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 748
        9⤵
        Program crash
        
        PID:5060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 748
        9⤵
        Program crash
        
        PID:17204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 628
        8⤵
        Program crash
        
        PID:3168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 708
        7⤵
        Program crash
        
        PID:7844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 708
        7⤵
        Program crash
        
        PID:6472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 720
        6⤵
        Program crash
        
        PID:6436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 720
        6⤵
        Program crash
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12859.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34485.exe
        7⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 636
        7⤵
        Program crash
        
        PID:9960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 636
        7⤵
        Program crash
        
        PID:13020
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 724
        6⤵
        Program crash
        
        PID:7364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 748
        6⤵
        Program crash
        
        PID:8364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 744
        5⤵
        Program crash
        
        PID:4568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 720
        5⤵
        Program crash
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50101.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35112.exe
        6⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7975.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60306.exe
        8⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58188.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35282.exe
        7⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63820.exe
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63827.exe
        6⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35973.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        7⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        6⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32843.exe
        5⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52879.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9383.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52019.exe
        6⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43061.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32519.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52770.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47706.exe
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        5⤵
        
        PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61459.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21573.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60696.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29054.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9825.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16642.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
        5⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22517.exe
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        5⤵
        
        PID:14000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7083.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60805.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60607.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9162.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14481.exe
        5⤵
        
        PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16514.exe
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36103.exe
        5⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        5⤵
        
        PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10852.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33129.exe
      4⤵
      PID:15176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57317.exe
        6⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        8⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3809.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1733.exe
        7⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        6⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        6⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        6⤵
        
        PID:564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
        5⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12675.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24172.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27210.exe
        5⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        5⤵
        
        PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58955.exe
        7⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        6⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        6⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        6⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62758.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42395.exe
        5⤵
        
        PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40051.exe
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47093.exe
        6⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60267.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37611.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42331.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
      4⤵
      PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37684.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        5⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59589.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36203.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33665.exe
        5⤵
        
        PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46300.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20356.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36570.exe
        6⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56328.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        5⤵
        
        PID:13548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1938.exe
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
      4⤵
      PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
      4⤵
      PID:1120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40607.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29736.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28970.exe
        6⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        5⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50659.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30763.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19458.exe
      4⤵
      PID:10484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
      4⤵
      PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48731.exe
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29447.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        5⤵
        
        PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
      4⤵
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
      4⤵
      PID:16324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25163.exe
    3⤵
    PID:7640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17188.exe
    3⤵
    PID:10464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29657.exe
    3⤵
    PID:13768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        8⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        8⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43278.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46011.exe
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58171.exe
        6⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42146.exe
        6⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26315.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60072.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51007.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
        6⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38603.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14743.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31953.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36434.exe
        6⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53459.exe
        6⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
        5⤵
        
        PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43891.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56773.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36458.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48808.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49507.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
      4⤵
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21659.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1879.exe
      4⤵
      PID:7464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7348.exe
        5⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9127.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        7⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        6⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49259.exe
        6⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1191.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
        5⤵
        
        PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3179.exe
        5⤵
        
        PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19771.exe
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        6⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20885.exe
        6⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      4⤵
      PID:15284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47043.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23301.exe
      4⤵
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65304.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48664.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24062.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30955.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
      4⤵
      PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16443.exe
      4⤵
      PID:5436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
    3⤵
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        5⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        6⤵
        
        PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50091.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        5⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26751.exe
        5⤵
        
        PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19547.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54651.exe
      4⤵
      PID:17268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33042.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      4⤵
      PID:14936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
    3⤵
    PID:9716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58100.exe
    3⤵
    PID:13984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
    3⤵
    PID:5596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
      4⤵
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15829.exe
        5⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28203.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
      4⤵
      PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48536.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58556.exe
        5⤵
        
        PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      4⤵
      PID:14876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9300.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49891.exe
        5⤵
        
        PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10242.exe
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26475.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60035.exe
    3⤵
    PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7300.exe
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54491.exe
      4⤵
      PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
      4⤵
      PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6542.exe
    3⤵
    PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13651.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
      4⤵
      PID:16948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5665.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5665.exe
    3⤵
    PID:11780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28666.exe
    3⤵
    PID:13068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41256.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62232.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29029.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49707.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
        6⤵
        
        PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8987.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        5⤵
        
        PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9904.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57782.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17418.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37345.exe
      4⤵
      PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64767.exe
      4⤵
      PID:5372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        5⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        6⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55467.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12449.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7370.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
      4⤵
      PID:9148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44499.exe
    3⤵
    PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
      4⤵
      PID:16752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61202.exe
    3⤵
    PID:10256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
    3⤵
    PID:14780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12823.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3443.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18302.exe
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
      4⤵
      PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
    3⤵
    PID:7804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
    3⤵
    PID:10928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
    3⤵
    PID:14972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41621.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
    3⤵
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
      4⤵
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3106.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44047.exe
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11553.exe
    3⤵
    PID:13908
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48173.exe
  2⤵
  PID:8036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56578.exe
  2⤵
  PID:6412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4552 -ip 4552
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4552 -ip 4552
1⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6008 -ip 6008
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2392 -ip 2392
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4624 -ip 4624
1⤵
PID:6776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6008 -ip 6008
1⤵
PID:7348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2392 -ip 2392
1⤵
PID:7372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1136 -ip 1136
1⤵
PID:7840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8756 -ip 8756
1⤵
PID:8364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4624 -ip 4624
1⤵
PID:8988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1136 -ip 1136
1⤵
PID:9176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5832 -ip 5832
1⤵
PID:10192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5716 -ip 5716
1⤵
PID:9480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5716 -ip 5716
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5832 -ip 5832
1⤵
PID:12368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7948 -ip 7948
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 7948 -ip 7948
1⤵
PID:15640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 336 -s 11644
1⤵
PID:17396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:944

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10110.exe

Filesize
468KB

MD5
792643f0d43aa510a8587dd97e8614e0

SHA1
0f9601bab6ae2c628c42c070b0a5479e76c25598

SHA256
cf8471d1c4694cc3c8b0821bde5d0f89d3802e851b26f2673cb50f6fc49adc57

SHA512
c0d3f2bdeaf438e6963ba740a17d38deae9f63ad1e9ca7832fe0e6016981580b9c063a8729a989a2a11ee0e47372c3755f5d95b54d9a1aa1c9b80042b4f0a787

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe

Filesize
468KB

MD5
326c79041977b79b4518b7027f0a2ca6

SHA1
b073bedaa5a108c2cda65caa7e83d34f15e4964d

SHA256
3c4864512e6e454e2fdb855528289d946fa309190dcda542abde6b637f4d422e

SHA512
8890b37be2aebdbd07b9f2fee1aa0142eea6804c7512c23e6676ac8942a941e98e370ca31b89d566afc42aa817e115d1226e3e991c53404aa364f883b5f88a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10706.exe

Filesize
468KB

MD5
01e2aa507f2f5cb18fac820f10e9f6f3

SHA1
946133b5f3901b3f91c0d05461902358726af87c

SHA256
0b65a7f64af155fb45ad092fd1eb21f92142c5fb6e6801f2581ad711488e951d

SHA512
8f1b761e371ded9c964db52ced83aa4559c2bc17b58e19e645f9d0a805d7d2b88efa91df0022a00e3df376b52376b678122d5fa341b7b68d571ab0ab8500b7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe

Filesize
468KB

MD5
1437f29951af0cab12e507d147ddb58c

SHA1
4bd34aee4db1d979f38f725f52705c7d1471554d

SHA256
90afec79f3468b876d148eff796b9afd9df077e4500182876f57906effaff138

SHA512
fab2cbfb496bdaadf185d3339a947b31f9b32bed4560d6142b821cbe6f151c81939c2319212a46191fdcae65f66517501b33db418beefe158735477ba99c0f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe

Filesize
468KB

MD5
025d120205c9c5fb858a894a4c851950

SHA1
533d2507bd258f4e60f39ed22e820787dcc32f68

SHA256
91c41b1c6b2d6607459c355c63b3e0551f3f17d025a20bc31e6899c21de73d36

SHA512
752db1363f0efd4e630015e115e8bdc88c06db642dfcacc28a32fb7c138890d77e68a4e9ad4f0e017bdf9ea68f7b706464573f2d4c2c4aec46cf2f75ec01001b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe

Filesize
468KB

MD5
04fc6682fd59005eb9c24820fce64f50

SHA1
c748fe9c7f1cb8ef534a102a3cf6cdf113d12c2e

SHA256
e819f79292e597076cb0e26f9873980d6cea9edfacaa264ab8581d35a7dfa7cc

SHA512
19a05f217eeb3846a3a99fc55cc1832dd8d72916b67f44158d721fa5f52d27f35d9909d28a2adb63d3d43c78795a5563790471b64a8753e136161fa2b12779c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe

Filesize
468KB

MD5
2251ef11cac470a93a02f89697bf9bde

SHA1
111807256cdba8a7da3e8f7c02a5ad20f08b0b7e

SHA256
bda5572e2cd2938086d80f490d886dbdb7b665b48f8ead1be502972414470d0f

SHA512
975c52a2a03761e59976a1a2972cf62f80659b7739182f26d209ad524cb130d2b9937520c14a5bdbce202430cda1a257722f06ebb01bf8638f3540748e33f700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16379.exe

Filesize
468KB

MD5
0c23540837f397acb254c63a54e6b8d7

SHA1
7824b406d31360d50fa42167154b257e32e539c9

SHA256
5390b6ad4abdba0fde2a4857b842262a216a8fa16059a36f6f8333df66781495

SHA512
1543918fab5b143ddc15a161b94c15ed339f3a2d39d9e19f22535f62be484298299bfd757358c8e70d20a931d617ae5970b734ff774a5fc4ef275c4422065da8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16645.exe

Filesize
468KB

MD5
384da1a23670228122acac5281da7286

SHA1
fad6cc3d728762ba91eafe18326cc65da1fd37d4

SHA256
14e9b20e5a70881f2b3ebd1f83e2e39a58ccba19ebc156b0786db2fb54a3f562

SHA512
ddaced1027257ac3cbe97b1d978ef5e9b822deed0a08c94632216877125ad215b360d9c21666e44863cb4480e9cec73c687c0707fd50e887fa9a39f1c00b5f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17221.exe

Filesize
468KB

MD5
5d42ff9f23a329d5167c598488552263

SHA1
2ac6fae47aa799645d33186d01b1eeb4da1ecebe

SHA256
64631e0b3ad5635df881eb27bd6ce5d5f4f3c0df4ecc84b693671d8d03f5cf19

SHA512
1bfb929bdbe5ff28f9d8dceb9e4c0795ca22b8b530b03380fc7e2191a0f4a642aff0cd04c61346a68f7231305a379e760be343c5cd9e2387f85dae6713ec40be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe

Filesize
468KB

MD5
f3cad62d22e2014285811b0dc3f32698

SHA1
2535242ddd21ed271ed53c36f37706c998d6f735

SHA256
425cc70df37278694e4f853d1e59d7ae693b1bdcb9cc659141f725d6d8c4225a

SHA512
3e54e8606c3c9e3b8c1762f676661810c0a346eb9b0fff2a556676d4c9a5b7a98e5d15c659c540382f28147f0c7694ec7e27666eb3ea0aef79110057e8f42c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe

Filesize
468KB

MD5
a599f734e7bda86d7e6d3f2c02139ae7

SHA1
4bd2af81b8c104ae92b2504fc47a5ec706f4b451

SHA256
6c96d7eda9e2b5277b6215bbc270781a489cf55160df05b445de5442037d0038

SHA512
209945b1dee836bb30bde5add1e35dcaf0d28a867be967a278fecce88a26e4e3da10452970aa98402fc82ebfec0e6966c3a1370c7e406b2307e1ed3e3ec5423c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe

Filesize
468KB

MD5
5094f88ef106e260f4ff88dd63a8cebb

SHA1
0399f52acb7a266c5cd111be84942445e687967a

SHA256
19a72a8da0b0b76dd13cd7f92f07b13874e03cf0ad8732c3a2db1c89622528c6

SHA512
4c49823294e815694c7ec5d38957988a256e788e6ecf2dfcace0673c1ed5d1fef6b5d0f67c9a6881e6cc7f20b1e2b2a1eb43e69cf0a1c88c420423a1bf889bd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24619.exe

Filesize
468KB

MD5
38e66fa770dc6c428053d07f266c4343

SHA1
821ff6e744f9b681bef313ffd82f1aaaa4f7853d

SHA256
c583b741bb8a06d2941286edd2393fcc2920d5edeb6a1a0b04d41f6ec80fe8c4

SHA512
f87668163bdef33c9ab043b3b913c05d74b1cfa8558993078e37f4995053a1602b6a73e805e4b4dcd5fd91ad75f45474a38d22cb8f3bc419ec3df172bbff94a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe

Filesize
468KB

MD5
f322b302a24520b3f81e9edb71d147ec

SHA1
643efd9e7431b64ac2fc688af80b96cb0562b0de

SHA256
29c1a4870631d32e494eb7d8be2ee3b5dd9a698e5bc77a9cfeb69943e57309d3

SHA512
84785681d48fb8e4305468d08d564e670994c91756c069255b351c5ab922a053fcbf9a511fd76db5d884432d3c6dbec0ce81484ea0866080327372089f9a1728

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe

Filesize
468KB

MD5
4575fcad8709c12d123ac4037c46ee0f

SHA1
3542a0bc4e41934a25cc50e8b02d5117389dff91

SHA256
1c73f5b075b0399f6a43111ab70b0d00e5e83571ebe6f14eb51ffdefe030dae5

SHA512
fd970f1d320d3d207305e50c1d1d3d87c9b33eae9ffa7016a868531da873ac91a7295c9d762eb86a1f9e0f31472244ce95ed8e6254eea9974640e902797fa989

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27791.exe

Filesize
468KB

MD5
fa6fdc01f3b13ef56c2eb6362e77cd0c

SHA1
9530fcf6b670c954778cb47421632874df26c645

SHA256
ae44bf3457d80a5199ae5b1d0d5f7d95a798f0268e603ceaa2c358934de06cad

SHA512
50109a796759a5aa78b6174856d31ce4f3c47e86c1fc53db305e8e2895ed13b463416388339ad17cbb5e31a41152b9281082553fc955044ab5229d01e344f934

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe

Filesize
468KB

MD5
cb8d88db78e37f32af496ecc7674cf98

SHA1
85aa4134d326294ea27803f0950e7a2084b839a8

SHA256
8cbfe2f6b07e0650c24831a61c8c4cdec86e4db0a1b67bcb7a49f684ca46fac5

SHA512
36fed8a513bb0f911c2392d171d135428c08d42eb5d19558a70a4d19e531bac7608d8a7b2daec40aa800cf6fcb5fcd77eda2d99a2a08172980159b618b43e0f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe

Filesize
468KB

MD5
954eafbaf1caea708a89353f2805ed74

SHA1
e9b486b83943e0ee28a14756dacd74279fab739a

SHA256
b56b8019fa2999d008cfce6daefe0eb68f6ecfd04c6b2f2db9fcd36184055a01

SHA512
8c59c16f250ce7b42d9b5822a568a4eeb94f20cc6ad60fb09969d956358f91b2618614fb110364351ab9a4636ea9886218013470be0c70ecfdde9c93c169f1e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30677.exe

Filesize
468KB

MD5
f80c8a42bd8501bf253d1902a0f271d2

SHA1
d46ad2a40bb62ae23bc23076454b3fbd10b08729

SHA256
0359139d18510e27da4c653d6bdb1a90762868e917a168cb5b1c92187f825727

SHA512
d915f14c2ca0f33383a5ee3f77942a97ddb2d5dc407829435ac62a15e7e8467bd5d7d824a81ac41a10820b6492113233cdf60f7f3ca73f4beb9142a771145fd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe

Filesize
468KB

MD5
d361c0de32b7682c35b7eee6947d217d

SHA1
fe05a3d17934b04704b379630bfadcad3008a45b

SHA256
9d122556c3e8b5f2c42c3a9340a52f01c8479b55e3b74ed7c292c89f5c950c10

SHA512
93efe22c9d8ba9d9e27cea0b8cc833ba2e32a24baa4e253ee1027fde50de0efdc0eeadb5b9e31ce71513a964538e844d556fe55cc4c3e9a8f74bc2891de51d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe

Filesize
468KB

MD5
0a73718610c6099437fe5afcafb580d1

SHA1
09d5f8c3b79830e96eacf4eeb17183d3939a205c

SHA256
e5e31afe5cf9f6cdab9114118465a348ba5d60cda055be2009057d7fc80d92f3

SHA512
0b3a30f2f9884cc3127e1cd87d98e5f999becc0fd1dd20341683559cf99f9d120b9567739854adc3825b7d304476a1a0a35b6aa6b73ef8355d825dc7409e54c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46120.exe

Filesize
468KB

MD5
a97eef888aee9c0dfb41afb35e20c8f1

SHA1
60a8a3583595aa24211fc2e8b4fc5091e4bdae91

SHA256
ccf3134b496c36c97efb1fe9d37fd85f3e09aa12c70fd7bf1de3499d3dd9d95d

SHA512
28ab3cb43d0de5d9b5ba40185cd8c9db387bee20ccf05684e3bb12eff25275e73c0cae79995eb4290fd886e1153ac3a63687a37972eb0be21d9313d149697c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53948.exe

Filesize
468KB

MD5
552a05e1e48316821c1d7a9370c95e09

SHA1
b5a6c868b955b12f15ea203d048170a927227407

SHA256
a5106be3d62fdd4ebecfcdc8477ce3fe7d56bd3ff5486fbe2b0d0957ad4c17ef

SHA512
7059b8f070317c18dd22977d78b1c988b006d897a0189b4eba05ce9a60316d8331cb2327433a07af6b4af6b5e2fe4e8dc1c95dc37dba9521dc81a03d62deb0e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57132.exe

Filesize
468KB

MD5
140ce8a5755e58415075abbff3be2af1

SHA1
24d03a52cfd8a60c9f55cdcf48f564f571b4edf0

SHA256
b628bbbc232128414992885091313c664828445a60cdca807a1148fb4fd396ed

SHA512
edd346bbb04647e6dda2993a28eaebc87982f3bdf58d1ecdfbf725d4057e5f8bdd35768d24b64f21618a6882afee2cb51752e1be0c5257c5ce996d0221e389cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe

Filesize
468KB

MD5
baeffb0305012864d517a44f262c53de

SHA1
fb86d3e1b0b96d7f56a7931063a4e74612c4a779

SHA256
e7e14fabf4a75eddc6d51d79eafd82e6ea1f8705eb6bf902502bb86a7146e4d8

SHA512
f12467545a97da74bc1353aabbb1c25dde7e586c442a32ed099811c92d62ba95bef98ba155e35d5f666c162be9de45a67565b94223b5e24e9569f95db3dc62c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe

Filesize
468KB

MD5
2706c065565b02397087e389c9603bf5

SHA1
0b9794e218ba40ff4504ea3cb59b039734142740

SHA256
78911f091a12517668f42faaca6a179da34d1dd217fb13d8459dce6a5f41021e

SHA512
02f80da88ebfaff7de113a3567061becaa92600adaf02e06ce7abe4f0c2fd4e7ae2bc80626b39f8bed25c37b1d9187f8ea656e88b39a4f496ae6c9d544599634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60133.exe

Filesize
468KB

MD5
bea279350ebb095cb3b8be98ae96d131

SHA1
c75689271c8bbf6b7498a3fde98cf1022aaf3fe4

SHA256
a98cb2b041e54b83951bc68ea81e05236908d68af8ea1b65ffb1d5d87ddffafd

SHA512
908b886f9ddccc0c5cc565b58fbd98f388f7702ca15780d1f204f481221f1b0e5f9f5461e04a44ddcb9f0bcd2ea67679ec27f81ac6b96492f43ede68f082fb85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe

Filesize
468KB

MD5
88855670d270bf6443b17caa998f2f01

SHA1
0473b0ea480fb49e14b8b1caa5d9348333f65dea

SHA256
8c1acd3aff7561a593b9dd6e5156e3f975daa70ab11546f83bbeb4386887507b

SHA512
383430902a3dbfc805420fdd31ad7cfdc534664d8153d85e2586b3e7ced37d3603679094198f6b8986d0651ec794d15dcbccb960214141b187f4ae9a5a65d328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62892.exe

Filesize
468KB

MD5
a215eae1878a9ac2c7de70caa1475502

SHA1
ac342ba3a542cc23d8469da6a589f9cc00d0cff4

SHA256
fb7b0c8df81a3079146ba01e1b625438e842d49f50bc61e141c5bf9a8c5ae1c4

SHA512
179aa9b165f3a04ba24bc0f13979c5abea359fd049640aaad4055ea15b53b7e237aac17d5fe344767a6a0c1284b63cda09f63f209421a13dadf3ec44114b633b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe

Filesize
468KB

MD5
b16f908c66bc9cd37153185dedff5a23

SHA1
e258a0861cb5b5a1cd62266fa20b759cd26db0cb

SHA256
474ba4f38738c01ba3f67919cc13969a2fffe8a57abbd8c4d515efc7c0a402b9

SHA512
4915d410a7febccc715ced3ad6c19bb770f91dd3fc534aadf1247b6c6e659891bdbb5b6fa3501096bac3aae638d84570679e6f39fc6e5b185e9320d0a9c1007a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7906.exe

Filesize
468KB

MD5
056e0d543d1ca20843f57ba4718dcfaf

SHA1
c2bdc37daad112faff9e0b616e4c965836ed48c2

SHA256
5c07e39da351e5cec1403fb9b8257ae70a063e5b63483c312b52ad9f3785fd18

SHA512
ded1eb35c74ee0ef64c67880356d37b14ed62aafbf41eeed44554e3c77b8ee857cbeffd9a6b2329e161553962a1d7bb63662a7dc47d844ac0c2aa16bc803e5a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8855.exe

Filesize
468KB

MD5
c91b1a7911e11e4df345b3504e527e40

SHA1
461dbf186554a729e31114b28451ccd0f0d403cd

SHA256
5a34536ca42b64286400275abf357a27fdadbd414ea2f938ed15e273b2c5422a

SHA512
1d0748d914aaa207a0ac5506a3dc0b368d0492128bb821d5f69fdec0ea3592109787b553aa39e3f8b56e723acfd5c2bf96a2edbb01749d05bbfdd88f8060698d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9067.exe

Filesize
468KB

MD5
80792413c4db869a4ebde858df0f9639

SHA1
0ff5ba8a1e3bc80571fec58cf0cf77fa65f5a1a0

SHA256
83c4fa49384e3e387bc9ced2fed36a12ddfb7cce52e17d84841e3681d1564a0a

SHA512
710100fc18fa86b1853a148af16ddbae84318587f547b9d0b5b8687bc52668af46ecc6efc28cf48175e8beabd0d482993404401f5ef0cc5deda9cd947b7561d0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads