dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932

Analysis

max time kernel
118s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe
Size

468KB
MD5

2ee57351bfec1f8980a5b5346e7f3c80
SHA1

0bfcd6763acc6f85a9c998c28e567ac5473bb064
SHA256

dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932
SHA512

e8b81bdfc2e75f72520a0b3cd025c0eef1bcfc98fcac380dedafcda3d06dc86be77ce879898df4b8f01d1c1feb0280ccdb3ff81dcd034d11ef700773dc030a05
SSDEEP

3072:ibzXogIdIq5UnbYHPztjcf8/sCtvP3pkhmHewVhtueP8iCuuGzlQ:ib7owuUnoPJjcfyZ08ueERuuG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3324	Unicorn-64697.exe
1396	Unicorn-31641.exe
2516	Unicorn-43872.exe
1436	Unicorn-47705.exe
2436	Unicorn-45437.exe
704	Unicorn-59172.exe
1460	Unicorn-24767.exe
4816	Unicorn-51177.exe
3560	Unicorn-50336.exe
3600	Unicorn-17353.exe
4456	Unicorn-17353.exe
1736	Unicorn-46775.exe
2088	Unicorn-33039.exe
1092	Unicorn-31961.exe
3944	Unicorn-26022.exe
3056	Unicorn-6408.exe
3276	Unicorn-51504.exe
3160	Unicorn-39958.exe
2488	Unicorn-29382.exe
2716	Unicorn-38313.exe
4256	Unicorn-38313.exe
2536	Unicorn-5064.exe
548	Unicorn-50736.exe
4852	Unicorn-37929.exe
1352	Unicorn-54192.exe
1504	Unicorn-48327.exe
4036	Unicorn-16025.exe
2032	Unicorn-48121.exe
396	Unicorn-64192.exe
2376	Unicorn-44592.exe
4820	Unicorn-61399.exe
2972	Unicorn-3528.exe
1700	Unicorn-39599.exe
2916	Unicorn-26985.exe
2940	Unicorn-59081.exe
4996	Unicorn-38831.exe
3760	Unicorn-19894.exe
4340	Unicorn-28329.exe
3628	Unicorn-54487.exe
1220	Unicorn-44473.exe
2336	Unicorn-24031.exe
3572	Unicorn-44089.exe
4496	Unicorn-60425.exe
2252	Unicorn-60425.exe
1996	Unicorn-43513.exe
1916	Unicorn-23839.exe
4284	Unicorn-56704.exe
2688	Unicorn-56704.exe
3940	Unicorn-11032.exe
968	Unicorn-45936.exe
3612	Unicorn-53600.exe
1528	Unicorn-20934.exe
4772	Unicorn-59849.exe
2872	Unicorn-20649.exe
3848	Unicorn-4504.exe
4460	Unicorn-4504.exe
2400	Unicorn-4504.exe
4764	Unicorn-975.exe
4488	Unicorn-16927.exe
2768	Unicorn-27862.exe
1556	Unicorn-30662.exe
4296	Unicorn-22185.exe
544	Unicorn-54784.exe
2912	Unicorn-7384.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
10080	4500	WerFault.exe	217
16620	7652	WerFault.exe	320

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34787.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44473.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29964.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5860	dwm.exe
Token: SeChangeNotifyPrivilege	5860	dwm.exe
Token: 33	5860	dwm.exe
Token: SeIncBasePriorityPrivilege	5860	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe
3324	Unicorn-64697.exe
1396	Unicorn-31641.exe
2516	Unicorn-43872.exe
704	Unicorn-59172.exe
1436	Unicorn-47705.exe
2436	Unicorn-45437.exe
1460	Unicorn-24767.exe
4816	Unicorn-51177.exe
3560	Unicorn-50336.exe
3600	Unicorn-17353.exe
4456	Unicorn-17353.exe
1736	Unicorn-46775.exe
2088	Unicorn-33039.exe
1092	Unicorn-31961.exe
3944	Unicorn-26022.exe
3056	Unicorn-6408.exe
3276	Unicorn-51504.exe
3160	Unicorn-39958.exe
2716	Unicorn-38313.exe
4256	Unicorn-38313.exe
2488	Unicorn-29382.exe
2536	Unicorn-5064.exe
548	Unicorn-50736.exe
4852	Unicorn-37929.exe
1504	Unicorn-48327.exe
1352	Unicorn-54192.exe
4036	Unicorn-16025.exe
2032	Unicorn-48121.exe
2376	Unicorn-44592.exe
396	Unicorn-64192.exe
4820	Unicorn-61399.exe
2972	Unicorn-3528.exe
1700	Unicorn-39599.exe
2916	Unicorn-26985.exe
2940	Unicorn-59081.exe
3760	Unicorn-19894.exe
4996	Unicorn-38831.exe
4340	Unicorn-28329.exe
3628	Unicorn-54487.exe
2336	Unicorn-24031.exe
1220	Unicorn-44473.exe
3572	Unicorn-44089.exe
1996	Unicorn-43513.exe
1916	Unicorn-23839.exe
3940	Unicorn-11032.exe
2688	Unicorn-56704.exe
4284	Unicorn-56704.exe
4496	Unicorn-60425.exe
4772	Unicorn-59849.exe
968	Unicorn-45936.exe
1528	Unicorn-20934.exe
2252	Unicorn-60425.exe
3612	Unicorn-53600.exe
2872	Unicorn-20649.exe
4488	Unicorn-16927.exe
4764	Unicorn-975.exe
2400	Unicorn-4504.exe
4460	Unicorn-4504.exe
1556	Unicorn-30662.exe
3848	Unicorn-4504.exe
2768	Unicorn-27862.exe
544	Unicorn-54784.exe
4296	Unicorn-22185.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3324	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	82
PID 1552 wrote to memory of 3324	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	82
PID 1552 wrote to memory of 3324	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	82
PID 3324 wrote to memory of 1396	3324	Unicorn-64697.exe	87
PID 3324 wrote to memory of 1396	3324	Unicorn-64697.exe	87
PID 3324 wrote to memory of 1396	3324	Unicorn-64697.exe	87
PID 1552 wrote to memory of 2516	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	88
PID 1552 wrote to memory of 2516	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	88
PID 1552 wrote to memory of 2516	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	88
PID 1396 wrote to memory of 1436	1396	Unicorn-31641.exe	90
PID 1396 wrote to memory of 1436	1396	Unicorn-31641.exe	90
PID 1396 wrote to memory of 1436	1396	Unicorn-31641.exe	90
PID 1552 wrote to memory of 704	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	92
PID 1552 wrote to memory of 704	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	92
PID 1552 wrote to memory of 704	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	92
PID 3324 wrote to memory of 2436	3324	Unicorn-64697.exe	91
PID 3324 wrote to memory of 2436	3324	Unicorn-64697.exe	91
PID 3324 wrote to memory of 2436	3324	Unicorn-64697.exe	91
PID 2516 wrote to memory of 1460	2516	Unicorn-43872.exe	95
PID 2516 wrote to memory of 1460	2516	Unicorn-43872.exe	95
PID 2516 wrote to memory of 1460	2516	Unicorn-43872.exe	95
PID 704 wrote to memory of 4816	704	Unicorn-59172.exe	96
PID 704 wrote to memory of 4816	704	Unicorn-59172.exe	96
PID 704 wrote to memory of 4816	704	Unicorn-59172.exe	96
PID 1552 wrote to memory of 3560	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	97
PID 1552 wrote to memory of 3560	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	97
PID 1552 wrote to memory of 3560	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	97
PID 1436 wrote to memory of 4456	1436	Unicorn-47705.exe	98
PID 1436 wrote to memory of 4456	1436	Unicorn-47705.exe	98
PID 1436 wrote to memory of 4456	1436	Unicorn-47705.exe	98
PID 2436 wrote to memory of 3600	2436	Unicorn-45437.exe	99
PID 2436 wrote to memory of 3600	2436	Unicorn-45437.exe	99
PID 2436 wrote to memory of 3600	2436	Unicorn-45437.exe	99
PID 3324 wrote to memory of 1736	3324	Unicorn-64697.exe	100
PID 3324 wrote to memory of 1736	3324	Unicorn-64697.exe	100
PID 3324 wrote to memory of 1736	3324	Unicorn-64697.exe	100
PID 1396 wrote to memory of 2088	1396	Unicorn-31641.exe	101
PID 1396 wrote to memory of 2088	1396	Unicorn-31641.exe	101
PID 1396 wrote to memory of 2088	1396	Unicorn-31641.exe	101
PID 1460 wrote to memory of 1092	1460	Unicorn-24767.exe	102
PID 1460 wrote to memory of 1092	1460	Unicorn-24767.exe	102
PID 1460 wrote to memory of 1092	1460	Unicorn-24767.exe	102
PID 2516 wrote to memory of 3944	2516	Unicorn-43872.exe	103
PID 2516 wrote to memory of 3944	2516	Unicorn-43872.exe	103
PID 2516 wrote to memory of 3944	2516	Unicorn-43872.exe	103
PID 4816 wrote to memory of 3056	4816	Unicorn-51177.exe	104
PID 4816 wrote to memory of 3056	4816	Unicorn-51177.exe	104
PID 4816 wrote to memory of 3056	4816	Unicorn-51177.exe	104
PID 704 wrote to memory of 3276	704	Unicorn-59172.exe	105
PID 704 wrote to memory of 3276	704	Unicorn-59172.exe	105
PID 704 wrote to memory of 3276	704	Unicorn-59172.exe	105
PID 3560 wrote to memory of 3160	3560	Unicorn-50336.exe	106
PID 3560 wrote to memory of 3160	3560	Unicorn-50336.exe	106
PID 3560 wrote to memory of 3160	3560	Unicorn-50336.exe	106
PID 1552 wrote to memory of 2488	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	107
PID 1552 wrote to memory of 2488	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	107
PID 1552 wrote to memory of 2488	1552	dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe	107
PID 3600 wrote to memory of 2716	3600	Unicorn-17353.exe	108
PID 3600 wrote to memory of 2716	3600	Unicorn-17353.exe	108
PID 3600 wrote to memory of 2716	3600	Unicorn-17353.exe	108
PID 4456 wrote to memory of 4256	4456	Unicorn-17353.exe	109
PID 4456 wrote to memory of 4256	4456	Unicorn-17353.exe	109
PID 4456 wrote to memory of 4256	4456	Unicorn-17353.exe	109
PID 1436 wrote to memory of 548	1436	Unicorn-47705.exe	111

C:\Users\Admin\AppData\Local\Temp\dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe
"C:\Users\Admin\AppData\Local\Temp\dcacb7a5cc96451714673425de4141c9b404a907573f13ace904760527236932N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20844.exe
        9⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        10⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        10⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        10⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20722.exe
        9⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8073.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61766.exe
        9⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        8⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        9⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3531.exe
        10⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        10⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        10⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
        9⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
        9⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        9⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39218.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4091.exe
        9⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        9⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57651.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        8⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6585.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39779.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13492.exe
        7⤵
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        9⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        9⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50237.exe
        9⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
        8⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        8⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31593.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37770.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12862.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
        7⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21033.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        8⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40962.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12916.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60163.exe
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22204.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20428.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42122.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        7⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19628.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13691.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1266.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36505.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47843.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46546.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
        6⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54487.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13339.exe
        6⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19116.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15788.exe
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        8⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43843.exe
        6⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13445.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        7⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47338.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24707.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64662.exe
        5⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        7⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        6⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37740.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40306.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        6⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62611.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6011.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
        5⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12011.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34060.exe
        9⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52195.exe
        9⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        9⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32834.exe
        8⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        8⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-818.exe
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65388.exe
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        8⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        8⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59587.exe
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33868.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        8⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53299.exe
        8⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5961.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50054.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4978.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18494.exe
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24031.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12763.exe
        6⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1061.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14370.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        7⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        7⤵
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62501.exe
        6⤵
        
        PID:17552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64461.exe
        7⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        6⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8059.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        7⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        6⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
        7⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54691.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64462.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18492.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        8⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57933.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61965.exe
        7⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39836.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52831.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24713.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        6⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53203.exe
        5⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64666.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57382.exe
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31516.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7652 -s 632
        8⤵
        Program crash
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10761.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8924.exe
        6⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        5⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14293.exe
        5⤵
        
        PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        5⤵
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        5⤵
        
        PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
      4⤵
      PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64124.exe
      4⤵
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22561.exe
      4⤵
      PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
      4⤵
      PID:10172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43513.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7579.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        8⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58621.exe
        8⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24084.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34828.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        7⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23839.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38348.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6242.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29375.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15410.exe
        6⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46243.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21369.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26754.exe
        6⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        7⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        7⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35491.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63594.exe
        5⤵
        
        PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27026.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14603.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        5⤵
        
        PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44947.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25068.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41874.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        7⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39914.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34905.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        6⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        5⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        6⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20818.exe
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        6⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        5⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46578.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57466.exe
      4⤵
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-619.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53155.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47357.exe
        5⤵
        
        PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
      4⤵
      PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        5⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3883.exe
      4⤵
      PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36746.exe
      4⤵
      PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60006.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        7⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27827.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26914.exe
        5⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        6⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45779.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34447.exe
        5⤵
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17004.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        7⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48474.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22949.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57107.exe
        5⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50012.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        6⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
      4⤵
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49747.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8533.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31564.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        5⤵
        
        PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22825.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52371.exe
      4⤵
      PID:13832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43820.exe
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
      4⤵
      PID:17896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13915.exe
        5⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39212.exe
        8⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27097.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45795.exe
        6⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        6⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5410.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64650.exe
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        5⤵
        
        PID:13968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        5⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1195.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3077.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        6⤵
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33897.exe
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16572.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14002.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11708.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        5⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44986.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46221.exe
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-66.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3378.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        5⤵
        
        PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7945.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4338.exe
      4⤵
      PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
      4⤵
      PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47925.exe
      4⤵
      PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3058.exe
    3⤵
    PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
      4⤵
      PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57852.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        5⤵
        
        PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36495.exe
      4⤵
      PID:17796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
    3⤵
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
    3⤵
    PID:11292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
    3⤵
    PID:17088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43872.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43872.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20860.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        9⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60938.exe
        9⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        9⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        8⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        8⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32748.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        8⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        8⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        8⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47354.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17957.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
        7⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33689.exe
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        6⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        6⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-975.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55820.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        9⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        9⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25260.exe
        8⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57386.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25253.exe
        7⤵
        
        PID:18124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62508.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63386.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45658.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        6⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        6⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49004.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57300.exe
        5⤵
        
        PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15227.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5013.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6402.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29497.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40978.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15214.exe
        6⤵
        
        PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5881.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49853.exe
        6⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49363.exe
        5⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3643.exe
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41324.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60218.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37129.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35007.exe
        5⤵
        
        PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51523.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61916.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42092.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47190.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30239.exe
        5⤵
        
        PID:17824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55235.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
      4⤵
      PID:11044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12347.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10729.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        8⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48476.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        7⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43898.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46915.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        6⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62563.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        5⤵
        
        PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16927.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52899.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20255.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52227.exe
        5⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17918.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60266.exe
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17708.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25474.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63082.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
        5⤵
        
        PID:15832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
      4⤵
      PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46356.exe
      4⤵
      PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4504.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51356.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27625.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3529.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29715.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26175.exe
        6⤵
        
        PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64227.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34444.exe
        6⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9035.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24898.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41770.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        5⤵
        
        PID:17572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24034.exe
      4⤵
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        5⤵
        
        PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27913.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17385.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62303.exe
      4⤵
      PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47564.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        6⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30291.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57350.exe
        5⤵
        
        PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5435.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48150.exe
        5⤵
        
        PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
      4⤵
      PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
      4⤵
      PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18434.exe
    3⤵
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12299.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
        5⤵
        
        PID:17424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2121.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
      4⤵
      PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
    3⤵
    PID:8008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14782.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14782.exe
    3⤵
    PID:4628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7384.exe
        6⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7963.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5675.exe
        8⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36556.exe
        9⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6917.exe
        9⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41106.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        9⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-377.exe
        9⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        8⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28025.exe
        8⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        7⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        7⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
        7⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        6⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        6⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4047.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28063.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48860.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
        8⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34259.exe
        7⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26630.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8297.exe
        6⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63722.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43660.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63061.exe
        5⤵
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        5⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10075.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
        7⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        7⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13026.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21580.exe
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24914.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17013.exe
        7⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62675.exe
        5⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49036.exe
        6⤵
        
        PID:7644
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 648
        6⤵
        Program crash
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43674.exe
        5⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        5⤵
        
        PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      4⤵
      PID:844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        6⤵
        
        PID:328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        5⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52723.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32284.exe
        6⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56611.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58463.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65372.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32476.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65149.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58554.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
      4⤵
      PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10945.exe
      4⤵
      PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54077.exe
      4⤵
      PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26985.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        5⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45228.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56643.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53750.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49802.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30828.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18505.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14795.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20085.exe
        7⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        5⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33909.exe
        6⤵
        
        PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12018.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50822.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
      4⤵
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27180.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47290.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
        5⤵
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13945.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33183.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        5⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        5⤵
        
        PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        5⤵
        
        PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11682.exe
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      4⤵
      PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20578.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25164.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14658.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        6⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16361.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        5⤵
        
        PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        5⤵
        
        PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40163.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
      4⤵
      PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48847.exe
      4⤵
      PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30371.exe
    3⤵
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10987.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
        5⤵
        
        PID:14720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      4⤵
      PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40186.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50780.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41789.exe
      4⤵
      PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22242.exe
    3⤵
    PID:9364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53100.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13149.exe
    3⤵
    PID:1580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13483.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1737.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33305.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2585.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57491.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40946.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2923.exe
        5⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31186.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23269.exe
        5⤵
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
        5⤵
        
        PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      4⤵
      PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
      4⤵
      PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2350.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56704.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34092.exe
      4⤵
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        6⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49075.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65414.exe
        5⤵
        
        PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62700.exe
        5⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58796.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        5⤵
        
        PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      4⤵
      PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-853.exe
      4⤵
      PID:17200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21049.exe
    3⤵
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25759.exe
      4⤵
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        5⤵
        
        PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36717.exe
        5⤵
        
        PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30162.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      4⤵
      PID:14912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6210.exe
      4⤵
      PID:15748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27839.exe
      4⤵
      PID:400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
    3⤵
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
      4⤵
      PID:628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
    3⤵
    PID:12296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
    3⤵
    PID:14704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57165.exe
    3⤵
    PID:17324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51004.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        5⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33868.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36242.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        6⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40146.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        5⤵
        
        PID:16340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        5⤵
        
        PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62115.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61491.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
      4⤵
      PID:17840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7314.exe
    3⤵
    PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
      4⤵
      PID:7012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64812.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32774.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13826.exe
      4⤵
      PID:10516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
      4⤵
      PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38041.exe
      4⤵
      PID:2764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
    3⤵
    PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6722.exe
    3⤵
    PID:9240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45204.exe
    3⤵
    PID:16888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
    3⤵
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63459.exe
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
      4⤵
      PID:13808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
      4⤵
      PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29250.exe
    3⤵
    PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
    3⤵
    PID:10104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
    3⤵
    PID:14208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7381.exe
    3⤵
    PID:5788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49231.exe
  2⤵
  PID:5716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31263.exe
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41634.exe
      4⤵
      PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58902.exe
      4⤵
      PID:15816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
    3⤵
    PID:10464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62765.exe
    3⤵
    PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33491.exe
    3⤵
    PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45615.exe
    3⤵
    PID:17140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42833.exe
  2⤵
  PID:5896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
    3⤵
    PID:11480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4290.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21498.exe
  2⤵
  PID:10772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
  2⤵
  PID:15968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4500 -ip 4500
1⤵
PID:9732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 7652 -ip 7652
1⤵
PID:16940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3976 -ip 3976
1⤵
PID:11084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe

Filesize
468KB

MD5
87d5b815dd280e846702f4542159daaa

SHA1
573ad2fc9c2bd09962d7b325bb88d703960da670

SHA256
c4d7d2990da939fbf29fb23ffa192329fc690d21ce9a1545773a09e84fec488e

SHA512
48c63cdeec74847da695c8c37bf40703f0531600116ba8d284462efd4551d27e73ecb64969000d06e2ea36c7e036c9a93730a136957a5b79e409c01311829584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe

Filesize
468KB

MD5
64f1c740903248ba91ad11a5232a57a4

SHA1
f83b8962e10b140c7c3f21a82c01b7df99d5abd5

SHA256
64bb79cebee6eae80ab0eaa56d66986a16a757e04ae05a2ac5a88e7952053da7

SHA512
61f3d096ce5daa606296ef2dcaf543e5b32e84e511026061f64eb975f76ebd53481bbf96f05f1814a6fa1d9fd61c07d51092a1fc3f9cb34b9177bd5ca787a8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe

Filesize
468KB

MD5
598c2ff72ecff71625f889112308a2a2

SHA1
3989dd27b17166ccad8f802dcc0c63036b50bb62

SHA256
447c5a54b830b811715641d45f1843e88ed022cc5bac6ce544d6386691a9dae8

SHA512
5571add70b4898fd0438f8b1021bf2246bff42a3567a15c676667a8e72080f2e133ec3125b237434e554d8ad574e5cc359787a29521bbb061408eca2be1bf12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe

Filesize
468KB

MD5
07242a7de19ca0e868fe4dc651346fc3

SHA1
219d9f500dccc668cd92c1403505eccfe327d576

SHA256
7daa68b6f80fc201cb335b7a34875c8fefc006fef10e64f3eeefed60b8fead5e

SHA512
fc7ad026f9bba5661318815f1fe34d89be81df5914a7095faaf9c048af93efb1ec18d45265af902a5d820e02b6d58b744924a5e2b6322d04f951cbbe2ea10024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe

Filesize
468KB

MD5
f167460c37ecdb7218ab27f8fb834280

SHA1
fc5f6c390c123f3d276b9363a3d39adc29831e3c

SHA256
b3543a75904c7bcaf27a2b0866211b83a11a67978b2b35c2cb08b7b5ffb57593

SHA512
c3c4f095d1bf92118ba3061285d5ab80e49363bc8d83300443a170174d67d6bcc99cdf92f5776b6cfb6c0c3a18873f5036410fa144944019d2c656a32613b1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29382.exe

Filesize
468KB

MD5
51cf10fd186a132cae7b9362cddd8633

SHA1
430a9d83c19d2202aec17d3b142a4ed2a5e4b0f8

SHA256
786da9c4e6c1b14eeee5db0513d5947e798a7284c663626a81df54db92adc708

SHA512
4fd39679c11988098c4a5eb4686a13c3919d2dd5bad44410457274d81bbc079e449872ce8c8e977a8a19f5a9830fa25e27eecec00c1247589ead7d95d71074c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe

Filesize
468KB

MD5
d4a5f3939a90646c576c5cb00ca8a7db

SHA1
4b71d0eed5a0c9b80ce317e170f9a0cadafe9bb9

SHA256
5f8d507c93d8a99b564883c9c5620e2cd83c1115cf72171514219f64855a6355

SHA512
04a53b1a75f5cc923cd2c1d72091d04ba39af1de717396f6130ef08f85f02f85f328c6ac8012f57a68d8076414ded16a87ea38b5a7960ec4cd0000440e1cef7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe

Filesize
468KB

MD5
4c4f6e29aab428c60b35b615f0f68133

SHA1
f5459973ab5070b898cab8dee05c198749060086

SHA256
cbf0f15e7c9a6aefb8908503add8cec0f4dd731ebfdbe62da42e756031624379

SHA512
4018ac01d673938cf3babaee1468a4d1363ebf5299272a02579ab9227b2383ff339d3ed06a6ea160ffc7747226c148e4111a345f55cbf2b8ef058bc1f8ccd7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe

Filesize
468KB

MD5
9a6b88a28a4db8c3b3a8059e80658ba7

SHA1
8d39c8f8978505d517b2ea6803e8ce030e99c28f

SHA256
941a53aab40cfd34511cdd42382015855c7beab4c351043d3764c9bcb91941aa

SHA512
4022466f25abe775fd420418dff5148cbe27bf18a9d6f6f9b91e328ec7cd6b499e333d8a4316c35038341fccf97c24c243f05b74a373b3c6785be722b74fe155

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3528.exe

Filesize
468KB

MD5
49af6ae054420f27e98aa58202c00c8c

SHA1
6f97a8f63db1a9004db7d886c4ecdf6435b58044

SHA256
4bbd300aa50bfd6dd706226af79b3aefcac0039b5c9aebda8f8be4e434503994

SHA512
6ad43b918e8eda5544d2d736a057e022030bc36a9f1b74fe946ea5734021110f4154b3338981a549de398020465c4ef85fd7ba36c907bdfa23237456a595f824

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe

Filesize
468KB

MD5
160c9b643e2053c0be341ab7d49318da

SHA1
b67b348be552ab187b70fce371b847b7cd39a397

SHA256
f9412af8d9ad1c0bfc405180a385f2fa2c19097d3da102b1ba64abbd15073069

SHA512
39a7b46f68c3ac5c9db7ffb7d1471b56fedf2f1a60b113c485463d7581fc8e9dd235707b74fa8ffa497b8c8a5b2e2ce6885acee4435ee93548aee832422ce0fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe

Filesize
468KB

MD5
dacd17d2803a0ad17b977fd57a6ab182

SHA1
dd5a7be9a89c64b918124108e39a047c8065b4c1

SHA256
bea66a8360ec664797117e63442c51644af1b36486cd7d83bd600c509f1fc9dd

SHA512
2777f7c2a5eba524c8e3826623185a562178093dbc34a92f186a6f951c8983027eab548c41bfc63a8ceba1da3d356994d7ea789a7b49c718a1e169d1eac71e20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe

Filesize
468KB

MD5
329262928ca97d6a46059f084ba926ed

SHA1
1f05b0a08d118bd48220b82147b67261f31881af

SHA256
c5edc76ee1c86cc613d941ec5bfc539f3888436f5dc3345c34be3c50ee64c67e

SHA512
6a049a17b5158d1c5f589faf30dc225c740decfa8dccb68420cf2425472721cdf7756a4aec731f66ddcae21c41a76ac031c21be02324717973519e58314484bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43872.exe

Filesize
468KB

MD5
2f67129ffeeebb1ea802fc5e2e425def

SHA1
85d739192b0f8e8d401a0306c72461adc84e059a

SHA256
492de701e37f15f32dd6662c32aeddda0d1f1912f47939bc0a191e34a83af1c1

SHA512
7c942f970716f51e3c17aed227f047367c54e3bff0090520d78f32afde01978d4eddfd02c0f60793083200d25600f77aa7b70dfe0565babe2181c6d325f9f73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44592.exe

Filesize
468KB

MD5
bd37385276d57f2ce53e40941f8625bf

SHA1
b13310aa7820fea3b837ce6ed7b6f930748aa6c9

SHA256
4f9472e7da42f0a7ab7856a8379992844caa767595b7db58a5417cd4de76b07d

SHA512
ab28a3238e94bb05c49a315a9547e5df6f89c33fb3468fb2d4b22a5051c804e488d45604fb4eee4d6f53f5227e869c93da59b24e2eca6f1038bf6283411c5dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe

Filesize
468KB

MD5
5c7b31d834de960f110741fe311423d5

SHA1
56514080e91777116cf6d0353f349c5ea4b51b6e

SHA256
74af7b426a88e8184ed3f02d29536eda969300d463c64f1508b40b1469d7dac4

SHA512
f4994d11fc48e0f6b9843e8d189c0a123784965a9a964bc69b60bf4ea616c0516f29c089279afdc4eacf8e5715643af0aaeec5ddf6fbfee0922cc953cd305564

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46775.exe

Filesize
468KB

MD5
7992973bc67baf1d0e28ca3c77c597e0

SHA1
5950c8673bcbe3291ee73fe76c7b3864e6578731

SHA256
6e3cbb4a4754d198d1c7596aaca107c1a29ac29d4fff4c2bf312867c021888ef

SHA512
46875f57f450ed13a7d4bcfc909275daafe2d35962ac56638855de4858517ce83cec67258200de52d73920d539f33dee8913908ae925ec3c44bb6888681b3189

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe

Filesize
468KB

MD5
7ec4a8ffe50a9abd33aa077df5b7fad5

SHA1
8d9f543de9ca970ceda7e67a9ef1b2c61816f70e

SHA256
643e1a7534a4b58804d9e01bd23f26f667700c433ce0ded29af711946caaa30f

SHA512
c2db56d7f8c6f0bcb72eedd5e11c7a57d0d8755f108b9743e5cba582f2203531a7aa199155db4bdbc28f125c6ff972cb68c7ca16c559020d3ce64d0c0a92fe8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48121.exe

Filesize
468KB

MD5
b3ad0aeb0c7e8cad0633e577ac21c872

SHA1
09078b7ac5b17ae446242a25156f00c10c5d4f51

SHA256
7354845f45d0a6c619ed61ecb7cc8639ef281b351411b5566b6b2b2233d271c8

SHA512
b8d0f88422bb3274e78b7026cef9ad3dc7e4d5f813bd365ec11f09ab3a8bfd74a20c71a32cb59b0395ff549b85618b7531dc8754279f18ca9a4b25dadf22e297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe

Filesize
468KB

MD5
247310b0c3dc02ac5e3df64171f98b94

SHA1
6508cf59c269eebee9ac8c9332743ed9ad320636

SHA256
3fa59becde6d107536170343d401882095793e9d8b8b0a5613ae9989c4fd6eaf

SHA512
889f3866e22cbf270410e2c1d48d4f92b3434b51f3a36d7ebc97f1e5e035cf13ca428bef7f9b9caf637bcd71d6ec09744ec48a0f729b12e74ea49b09dca2f928

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50336.exe

Filesize
468KB

MD5
84c0a0e0dbbe2cd9e580657a44f93101

SHA1
a926369247bf282fb265d60eb3d4a247b3d7a6ce

SHA256
8f590add758e5dbde17cbf2ca317251ab058a6f76176772187ab2fa71b3a630a

SHA512
fb896b39a09854f35f25fd9d5fdd4b6f528383b2c96e5431977434affa4da2e75ed830d13a84122bdcef7842bb0c089afe29cb37b905b495a5fb399e986e7b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5064.exe

Filesize
468KB

MD5
64b37380258818a018d4839e8b63cd82

SHA1
d0da0fa2a1533318dd67ef33337f88ac1c844d8e

SHA256
eeeeaf2364fcfeca3a068e66d58e56378d4566e641266a864ab4d4e29fba5d33

SHA512
742cdc5a0f894cc0389e3bb1f3646e68621a18449d0ba9599cc5baf871a403aa7285110af88c34d0ebf50d82aadb008285625d0f0a1e841fcede7fcc8b27df81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe

Filesize
468KB

MD5
a118832a73f51273a2b9626f76ddcb2f

SHA1
fa1d1db398ffd4f609b821f694d94f23d6f8376d

SHA256
5e9460c5788c2639f9326cfc82abb53c50d7515ce065ea7e33364d7959f3ea46

SHA512
8251ed7f2f76ea659276ab9bd0f23fe10f43a7403240ca1b1296b74d02f22bc7ae48dcb7bcb14c85a1c41eaa59cf6150e4ef59fcbd1bfdebc3117b25e4db81aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51177.exe

Filesize
468KB

MD5
16b726b373f7a5ad8719a81d662014cf

SHA1
27423efcb27de55ae925ebb755c39bc32e817a53

SHA256
833cb04004a2e2e5186ab43648f11fede9f1437856905d629c4ae4c57f7b3637

SHA512
56ba6537059f3f5ee1b56ca326918cfd30045411dfc37a16524c2dfdee403243fdef9cef1576241dee1f74f7affae60025eecfea3e8666383c6db97faf943716

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51504.exe

Filesize
468KB

MD5
b5dee9fb9f63a5b6a4d5e52827e9aecc

SHA1
8910c4be80a08d25f0c00b34183947142e8828ea

SHA256
3ebbd0dd04902e82e043d837327f74a00eeb623b51122b394ef6f657871f8a3e

SHA512
a5d35f105d13dada69f47278ebc5bd749ef4b6b5d8e9a56b0e786839e477fed46ae60313c2ee9a46661e0e2c663d158b5095c455ef3326aa295f95e256f53327

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54192.exe

Filesize
468KB

MD5
2619af73ae9aed237a476892b5be3069

SHA1
28897d43df0f8f214ba4f303d0e7bce7de35496c

SHA256
444a51255bbd29290c185ef111830d8bd9beebfefe9b48f8daf533703ef35e17

SHA512
4453f617a6741f3e3f052288abc773b8f5daf4e0c8422778defbb7e0b0777124a52b334945a1bd8bc1c288c6902ed64b7b58895592e6d67316e49446bacee2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59172.exe

Filesize
468KB

MD5
cc5afa980300501dd2c40f8ed64721a9

SHA1
7a2a4c335c8f1cc6c8c8ad6802d5c0f89967d224

SHA256
325add34de52a224550c4ef1419ca4a9320e59247220990fbc4073b0eac87c5b

SHA512
7c5703c8b313beb5ec173317f1630f1b83229bced6fa5601cbc85ac6261bd6ab48840c7000475f47db6583e3b3596a55440c9ed41fb2c60dba493074229d18e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61399.exe

Filesize
468KB

MD5
bf22d33fd1d244d78898a73f0d88ea4d

SHA1
c7a7aac09b2127db00c36d46e66a87f6133403c5

SHA256
891c08927d9e949118b7c98a504c414adcec8fbf41512ef298a0cb33c7cf1424

SHA512
66b4b99404c671c2aee9101ff7b36e2ce57dbf7f3fab6aaa3a3d98e2a7e141e3bc809418a22466d7329dd7d31c30548d5670d6a520a8d84e9142919b51fec5eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6408.exe

Filesize
468KB

MD5
b575e64986694cf2499c621b031ec596

SHA1
719f97e0e6a233a1dd5f1758fce0abe09e60e405

SHA256
71b69d8830ed65da5fba3b2b1ece3e953d38a47e145e49c2a890ba793d533b4d

SHA512
a75ed03c464bda5f2fb8e25eedeb5d7ba88232f9c4c4cbad38031ce79bea3d362973233e28f2d955574932ef8217b7dc6751a8be3246344202e6eea8cc6ca5c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64192.exe

Filesize
468KB

MD5
da0eb09248e3ec18d602d7c100a625b9

SHA1
3626abce71d05ce115d21b0234307f0f690730a1

SHA256
0e9060350daf33f56d9e13da73dbe905a49f66c1994afc7a8dc252544fb72834

SHA512
0ecda9521e09b9a1e5dcc97a1bfbfe9e51050d568eb232387dc79f51725e8bb62b9fc4a36fb30613abfcfa480229a40cf8f3a022683b67becbe7b575ed3709e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe

Filesize
468KB

MD5
941109431b5af207769c3c32af4e8d13

SHA1
096e4cb1fdd4d5fb2a625262fe1c1ad90aae6352

SHA256
633dd212181dfe8fcac15a6f220ba95ee0076cdddf425ae789cf8e10893f3a9d

SHA512
7210845525fa46fb9073b381078bd97417643aed8914d3f58ba17583e3689b52db3658b5037bd31c427d83ec51a8829e8138bd6e8efc4250898856d2498dd8e7

Download Submit
memory/396-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/548-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1092-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1364-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4256-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13944-2543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads