67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75da

Analysis

max time kernel
116s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe
Size

184KB
MD5

d6cc6a2f87688d001f73000f06a06cf0
SHA1

0bb788a31efc1806e71ef7b2ca1e031c386a8d77
SHA256

67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75da
SHA512

5894aa7c199c0ca0cda9b67bc6fa8ac0ff7812cc1cd71f8230164e9b6a2813dd2e091bc731d62db63a924eec1126ae80ad7c4a899eda9e7faeadcd2b1c649f85
SSDEEP

3072:vWRBBFo2dju9Z+i9rjP8SCP2lvnqXvGuo:vWjozX+il8xP2lPqXvGu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4964	Unicorn-43662.exe
2464	Unicorn-56350.exe
640	Unicorn-20148.exe
2712	Unicorn-26670.exe
3040	Unicorn-37068.exe
4776	Unicorn-23332.exe
2480	Unicorn-56981.exe
5008	Unicorn-42145.exe
4572	Unicorn-23348.exe
988	Unicorn-59358.exe
3612	Unicorn-59358.exe
1140	Unicorn-6907.exe
4284	Unicorn-12772.exe
4984	Unicorn-24382.exe
2816	Unicorn-34395.exe
4520	Unicorn-41486.exe
2348	Unicorn-12212.exe
4444	Unicorn-63790.exe
440	Unicorn-63598.exe
3412	Unicorn-57468.exe
4816	Unicorn-54668.exe
4076	Unicorn-30926.exe
728	Unicorn-14589.exe
4188	Unicorn-63141.exe
5012	Unicorn-60069.exe
320	Unicorn-8253.exe
964	Unicorn-7604.exe
3844	Unicorn-27470.exe
3456	Unicorn-27013.exe
5004	Unicorn-44766.exe
1812	Unicorn-24708.exe
516	Unicorn-28238.exe
1720	Unicorn-40852.exe
4532	Unicorn-21915.exe
3744	Unicorn-5195.exe
5044	Unicorn-62254.exe
4940	Unicorn-8455.exe
1108	Unicorn-18446.exe
4424	Unicorn-2109.exe
4416	Unicorn-2109.exe
4200	Unicorn-2109.exe
3948	Unicorn-53998.exe
1216	Unicorn-4989.exe
2516	Unicorn-4989.exe
2880	Unicorn-44868.exe
2692	Unicorn-61404.exe
2012	Unicorn-50469.exe
2576	Unicorn-50469.exe
1220	Unicorn-14811.exe
1420	Unicorn-20676.exe
4896	Unicorn-12576.exe
2192	Unicorn-26260.exe
3864	Unicorn-62654.exe
1640	Unicorn-13261.exe
1852	Unicorn-42596.exe
992	Unicorn-20475.exe
1700	Unicorn-23275.exe
5108	Unicorn-13344.exe
4008	Unicorn-27028.exe
2356	Unicorn-49198.exe
3364	Unicorn-49198.exe
4148	Unicorn-32862.exe
2940	Unicorn-10203.exe
4980	Unicorn-62005.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1528	3744	WerFault.exe	130
9356	9056	WerFault.exe	406

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17924.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20148.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17148	dwm.exe
Token: SeChangeNotifyPrivilege	17148	dwm.exe
Token: 33	17148	dwm.exe
Token: SeIncBasePriorityPrivilege	17148	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe
4964	Unicorn-43662.exe
2464	Unicorn-56350.exe
640	Unicorn-20148.exe
2712	Unicorn-26670.exe
3040	Unicorn-37068.exe
4776	Unicorn-23332.exe
2480	Unicorn-56981.exe
5008	Unicorn-42145.exe
4572	Unicorn-23348.exe
4284	Unicorn-12772.exe
1140	Unicorn-6907.exe
3612	Unicorn-59358.exe
988	Unicorn-59358.exe
4984	Unicorn-24382.exe
2816	Unicorn-34395.exe
4520	Unicorn-41486.exe
2348	Unicorn-12212.exe
4444	Unicorn-63790.exe
4076	Unicorn-30926.exe
440	Unicorn-63598.exe
728	Unicorn-14589.exe
4816	Unicorn-54668.exe
4188	Unicorn-63141.exe
5012	Unicorn-60069.exe
3412	Unicorn-57468.exe
320	Unicorn-8253.exe
964	Unicorn-7604.exe
3844	Unicorn-27470.exe
3456	Unicorn-27013.exe
5004	Unicorn-44766.exe
1812	Unicorn-24708.exe
1720	Unicorn-40852.exe
516	Unicorn-28238.exe
4532	Unicorn-21915.exe
3744	Unicorn-5195.exe
5044	Unicorn-62254.exe
4940	Unicorn-8455.exe
1108	Unicorn-18446.exe
3948	Unicorn-53998.exe
4424	Unicorn-2109.exe
4416	Unicorn-2109.exe
4200	Unicorn-2109.exe
2516	Unicorn-4989.exe
2012	Unicorn-50469.exe
1216	Unicorn-4989.exe
2692	Unicorn-61404.exe
1420	Unicorn-20676.exe
2880	Unicorn-44868.exe
2576	Unicorn-50469.exe
1220	Unicorn-14811.exe
4896	Unicorn-12576.exe
2192	Unicorn-26260.exe
1640	Unicorn-13261.exe
1852	Unicorn-42596.exe
3864	Unicorn-62654.exe
1700	Unicorn-23275.exe
992	Unicorn-20475.exe
5108	Unicorn-13344.exe
4008	Unicorn-27028.exe
2356	Unicorn-49198.exe
3364	Unicorn-49198.exe
4148	Unicorn-32862.exe
4980	Unicorn-62005.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4964	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	90
PID 684 wrote to memory of 4964	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	90
PID 684 wrote to memory of 4964	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	90
PID 4964 wrote to memory of 2464	4964	Unicorn-43662.exe	94
PID 4964 wrote to memory of 2464	4964	Unicorn-43662.exe	94
PID 4964 wrote to memory of 2464	4964	Unicorn-43662.exe	94
PID 684 wrote to memory of 640	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	95
PID 684 wrote to memory of 640	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	95
PID 684 wrote to memory of 640	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	95
PID 2464 wrote to memory of 2712	2464	Unicorn-56350.exe	99
PID 2464 wrote to memory of 2712	2464	Unicorn-56350.exe	99
PID 2464 wrote to memory of 2712	2464	Unicorn-56350.exe	99
PID 684 wrote to memory of 3040	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	100
PID 684 wrote to memory of 3040	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	100
PID 684 wrote to memory of 3040	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	100
PID 4964 wrote to memory of 4776	4964	Unicorn-43662.exe	101
PID 4964 wrote to memory of 4776	4964	Unicorn-43662.exe	101
PID 4964 wrote to memory of 4776	4964	Unicorn-43662.exe	101
PID 640 wrote to memory of 2480	640	Unicorn-20148.exe	102
PID 640 wrote to memory of 2480	640	Unicorn-20148.exe	102
PID 640 wrote to memory of 2480	640	Unicorn-20148.exe	102
PID 2712 wrote to memory of 5008	2712	Unicorn-26670.exe	103
PID 2712 wrote to memory of 5008	2712	Unicorn-26670.exe	103
PID 2712 wrote to memory of 5008	2712	Unicorn-26670.exe	103
PID 2464 wrote to memory of 4572	2464	Unicorn-56350.exe	104
PID 2464 wrote to memory of 4572	2464	Unicorn-56350.exe	104
PID 2464 wrote to memory of 4572	2464	Unicorn-56350.exe	104
PID 3040 wrote to memory of 988	3040	Unicorn-37068.exe	106
PID 3040 wrote to memory of 988	3040	Unicorn-37068.exe	106
PID 3040 wrote to memory of 988	3040	Unicorn-37068.exe	106
PID 4776 wrote to memory of 3612	4776	Unicorn-23332.exe	105
PID 4776 wrote to memory of 3612	4776	Unicorn-23332.exe	105
PID 4776 wrote to memory of 3612	4776	Unicorn-23332.exe	105
PID 4964 wrote to memory of 1140	4964	Unicorn-43662.exe	107
PID 4964 wrote to memory of 1140	4964	Unicorn-43662.exe	107
PID 4964 wrote to memory of 1140	4964	Unicorn-43662.exe	107
PID 684 wrote to memory of 4284	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	108
PID 684 wrote to memory of 4284	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	108
PID 684 wrote to memory of 4284	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	108
PID 2480 wrote to memory of 4984	2480	Unicorn-56981.exe	109
PID 2480 wrote to memory of 4984	2480	Unicorn-56981.exe	109
PID 2480 wrote to memory of 4984	2480	Unicorn-56981.exe	109
PID 640 wrote to memory of 2816	640	Unicorn-20148.exe	110
PID 640 wrote to memory of 2816	640	Unicorn-20148.exe	110
PID 640 wrote to memory of 2816	640	Unicorn-20148.exe	110
PID 5008 wrote to memory of 4520	5008	Unicorn-42145.exe	111
PID 5008 wrote to memory of 4520	5008	Unicorn-42145.exe	111
PID 5008 wrote to memory of 4520	5008	Unicorn-42145.exe	111
PID 2712 wrote to memory of 2348	2712	Unicorn-26670.exe	112
PID 2712 wrote to memory of 2348	2712	Unicorn-26670.exe	112
PID 2712 wrote to memory of 2348	2712	Unicorn-26670.exe	112
PID 4284 wrote to memory of 4444	4284	Unicorn-12772.exe	113
PID 4284 wrote to memory of 4444	4284	Unicorn-12772.exe	113
PID 4284 wrote to memory of 4444	4284	Unicorn-12772.exe	113
PID 1140 wrote to memory of 440	1140	Unicorn-6907.exe	114
PID 1140 wrote to memory of 440	1140	Unicorn-6907.exe	114
PID 1140 wrote to memory of 440	1140	Unicorn-6907.exe	114
PID 2464 wrote to memory of 3412	2464	Unicorn-56350.exe	115
PID 2464 wrote to memory of 3412	2464	Unicorn-56350.exe	115
PID 2464 wrote to memory of 3412	2464	Unicorn-56350.exe	115
PID 684 wrote to memory of 4816	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	116
PID 684 wrote to memory of 4816	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	116
PID 684 wrote to memory of 4816	684	67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe	116
PID 3612 wrote to memory of 4076	3612	Unicorn-59358.exe	117

C:\Users\Admin\AppData\Local\Temp\67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe
"C:\Users\Admin\AppData\Local\Temp\67314b772b202ff0187588c8898389518bd3e9b5642c545b72f0575de13a75daN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13344.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        9⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18142.exe
        10⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        10⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        10⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        10⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        9⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        9⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47999.exe
        9⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        9⤵
        
        PID:18288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        9⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        9⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        9⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        9⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        8⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        8⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11764.exe
        8⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        9⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        9⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        9⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49839.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62415.exe
        8⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46828.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31819.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27144.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        8⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17127.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        7⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        7⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36046.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        10⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
        10⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57951.exe
        10⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        10⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        9⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        9⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        9⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46389.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        8⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        8⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50389.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36222.exe
        9⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        9⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        9⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33927.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        8⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        8⤵
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43196.exe
        7⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23271.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65215.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46309.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        7⤵
        
        PID:18856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62.exe
        7⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62280.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2283.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        6⤵
        
        PID:18152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8895.exe
        6⤵
        
        PID:18604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63566.exe
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
        9⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41311.exe
        9⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        9⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        8⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51861.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33230.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        8⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26548.exe
        8⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6094.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        8⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20635.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14688.exe
        8⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62005.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21438.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25646.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53272.exe
        9⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        9⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        8⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24840.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        7⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26609.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        8⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        7⤵
        
        PID:19020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17559.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        6⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3319.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        8⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37269.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        7⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        7⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17924.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26222.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45592.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        7⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42168.exe
        7⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40357.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12502.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
        5⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        7⤵
        
        PID:16948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29860.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36337.exe
        6⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4251.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47422.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
        6⤵
        
        PID:18796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22195.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        5⤵
        
        PID:18124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52097.exe
        8⤵
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48815.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        7⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        7⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17908.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1470.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17851.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        6⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1182.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52289.exe
        6⤵
        
        PID:18696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33477.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        6⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4407.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
        6⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33236.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-461.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56614.exe
        5⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7359.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41889.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6077.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe
        8⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12695.exe
        8⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2478.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        7⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50561.exe
        7⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        7⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        7⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52920.exe
        7⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        6⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52481.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
        5⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1472.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39207.exe
        7⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23339.exe
        7⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16967.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36476.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58437.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        5⤵
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
        5⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63924.exe
        5⤵
        
        PID:19084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42574.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5277.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        7⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57224.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        6⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27560.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        5⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        5⤵
        
        PID:18780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1054.exe
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        5⤵
        
        PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51624.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44467.exe
      4⤵
      PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
      4⤵
      PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
      4⤵
      PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18446.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        7⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        9⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        9⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        9⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25448.exe
        9⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9028.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44895.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        7⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37700.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48101.exe
        7⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49953.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        8⤵
        
        PID:17840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29205.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22904.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61663.exe
        7⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19232.exe
        7⤵
        
        PID:18672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64078.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10599.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53119.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        7⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40933.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34990.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61774.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        8⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-631.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57717.exe
        6⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43326.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29639.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-654.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7335.exe
        6⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3195.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        7⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        7⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44472.exe
        7⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2743.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53868.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36391.exe
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58785.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16070.exe
        5⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9087.exe
        5⤵
        
        PID:18664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21153.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        8⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        8⤵
        
        PID:19104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        7⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        7⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        7⤵
        
        PID:19048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5179.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58440.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30950.exe
        5⤵
        
        PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27006.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        5⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13917.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        6⤵
        
        PID:17340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        6⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        5⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
        5⤵
        
        PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11748.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52014.exe
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        5⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53608.exe
        5⤵
        
        PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59711.exe
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      4⤵
      PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      4⤵
      PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
      4⤵
      PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        8⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        8⤵
        
        PID:19012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
        7⤵
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
        7⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60622.exe
        7⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        7⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        7⤵
        
        PID:16872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61279.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2704.exe
        6⤵
        
        PID:18848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21646.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34462.exe
        7⤵
        
        PID:15696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53487.exe
        7⤵
        
        PID:19004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56885.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        6⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3019.exe
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44088.exe
        6⤵
        
        PID:18684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44399.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25319.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1584.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61132.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6583.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        6⤵
        
        PID:17996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54017.exe
        6⤵
        
        PID:19040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        5⤵
        
        PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22526.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        5⤵
        
        PID:17356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49976.exe
        5⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        5⤵
        
        PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
      4⤵
      PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
      4⤵
      PID:18132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8541.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        7⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42360.exe
        7⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55151.exe
        6⤵
        
        PID:18308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        6⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63694.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-807.exe
        6⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
        6⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50415.exe
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18155.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40046.exe
        6⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9056 -s 408
        7⤵
        Program crash
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28398.exe
        6⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
        6⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2094.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
      4⤵
      PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61404.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        5⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        5⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
      4⤵
      PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47902.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19332.exe
        5⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38607.exe
        5⤵
        
        PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61592.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58255.exe
      4⤵
      PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
      4⤵
      PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
      4⤵
      PID:18764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1348.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
      4⤵
      PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
      4⤵
      PID:19096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
    3⤵
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16695.exe
      4⤵
      PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26517.exe
      4⤵
      PID:17000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28771.exe
    3⤵
    PID:10152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37871.exe
    3⤵
    PID:13348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
    3⤵
    PID:16596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16688.exe
    3⤵
    PID:4204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12576.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1069.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        8⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47685.exe
        8⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44556.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        7⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        7⤵
        
        PID:17920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13684.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12813.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        7⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55.exe
        7⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23995.exe
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64415.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22455.exe
        6⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19342.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44447.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11472.exe
        6⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        6⤵
        
        PID:18788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26843.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        7⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        7⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        7⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2814.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20743.exe
        6⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51176.exe
        6⤵
        
        PID:18864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11588.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45438.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40831.exe
        6⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49772.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        5⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        5⤵
        
        PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57342.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59909.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18235.exe
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3163.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17120.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
        5⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        5⤵
        
        PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23275.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1837.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        6⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        5⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35089.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59576.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        6⤵
        
        PID:18720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51521.exe
        5⤵
        
        PID:18640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53077.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62590.exe
        5⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5972.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        5⤵
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
        5⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        5⤵
        
        PID:18492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42084.exe
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64945.exe
      4⤵
      PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
      4⤵
      PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
      4⤵
      PID:18536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62654.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        8⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19070.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12948.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        6⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        6⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        6⤵
        
        PID:18528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33390.exe
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39151.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63169.exe
        5⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        5⤵
        
        PID:18444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-317.exe
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54965.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41055.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50289.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51096.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6830.exe
        6⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
        6⤵
        
        PID:18592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62085.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        5⤵
        
        PID:18544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42222.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59377.exe
        6⤵
        
        PID:2652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30564.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17038.exe
        5⤵
        
        PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4791.exe
        5⤵
        
        PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11390.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49855.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53448.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
      4⤵
      PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44790.exe
      4⤵
      PID:8308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20375.exe
        7⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54751.exe
        7⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        6⤵
        
        PID:17620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        6⤵
        
        PID:18568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27364.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28747.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38991.exe
        5⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        5⤵
        
        PID:18832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        5⤵
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49884.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45016.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        5⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        5⤵
        
        PID:18712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      4⤵
      PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
      4⤵
      PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
      4⤵
      PID:18736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20475.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
      4⤵
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
        6⤵
        
        PID:19076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49639.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22740.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47020.exe
        5⤵
        
        PID:18136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52796.exe
      4⤵
      PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
      4⤵
      PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      4⤵
      PID:18560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      4⤵
      PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
      4⤵
      PID:19068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
    3⤵
    PID:8296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
    3⤵
    PID:11892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33279.exe
    3⤵
    PID:14736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
    3⤵
    PID:17760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17840.exe
    3⤵
    PID:18820
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37950.exe
        8⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45439.exe
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27368.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24020.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5543.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53615.exe
        7⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5428.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20727.exe
        7⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27198.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13204.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34033.exe
        6⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5028.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54894.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56766.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30430.exe
        7⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        7⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3355.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11943.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        6⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        6⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50469.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        6⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1316.exe
        6⤵
        
        PID:18744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44094.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        6⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10839.exe
        6⤵
        
        PID:18808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53528.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16174.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56664.exe
        5⤵
        
        PID:16524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
        5⤵
        
        PID:18704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47144.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
        6⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28053.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7339.exe
        5⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28327.exe
      4⤵
      PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52257.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40991.exe
      4⤵
      PID:18576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 720
      4⤵
      Program crash
      PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4557.exe
      4⤵
      PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34110.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53829.exe
      4⤵
      PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57023.exe
      4⤵
      PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23240.exe
      4⤵
      PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27534.exe
      4⤵
      PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
    3⤵
    PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61454.exe
    3⤵
    PID:10932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12662.exe
    3⤵
    PID:14124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13532.exe
    3⤵
    PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
    3⤵
    PID:7560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2548.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62734.exe
        7⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        7⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44472.exe
        7⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64444.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23239.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        6⤵
        
        PID:17136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61000.exe
        6⤵
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54284.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38615.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18848.exe
        5⤵
        
        PID:18456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
      4⤵
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        6⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24295.exe
        7⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62639.exe
        6⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        6⤵
        
        PID:18876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4404.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17543.exe
        5⤵
        
        PID:15248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        5⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        5⤵
        
        PID:18628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64716.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63758.exe
        5⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51756.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
        5⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
      4⤵
      PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33761.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26628.exe
        5⤵
        
        PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38223.exe
        5⤵
        
        PID:18616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47084.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      4⤵
      PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31841.exe
      4⤵
      PID:18036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48046.exe
      4⤵
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40798.exe
        6⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11613.exe
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48280.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19294.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60879.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19214.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4087.exe
        6⤵
        
        PID:19116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61368.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        5⤵
        
        PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1780.exe
      4⤵
      PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31214.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59416.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20062.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33502.exe
        5⤵
        
        PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5083.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      4⤵
      PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
      4⤵
      PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63239.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9243.exe
    3⤵
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21054.exe
      4⤵
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47230.exe
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
        5⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19086.exe
        5⤵
        
        PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35732.exe
      4⤵
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2432.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40284.exe
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61845.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63983.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51105.exe
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
      4⤵
      PID:14296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58511.exe
      4⤵
      PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
      4⤵
      PID:588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34955.exe
    3⤵
    PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
    3⤵
    PID:12048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
    3⤵
    PID:15472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
    3⤵
    PID:18208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
      4⤵
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30964.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-718.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15278.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        6⤵
        
        PID:18992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51231.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8724.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24398.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        5⤵
        
        PID:19028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62709.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44392.exe
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5358.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61912.exe
      4⤵
      PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27630.exe
      4⤵
      PID:16232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51905.exe
      4⤵
      PID:18520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21364.exe
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        5⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        5⤵
        
        PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58421.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42015.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7572.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39775.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13211.exe
    3⤵
    PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27678.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51480.exe
      4⤵
      PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56415.exe
      4⤵
      PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60616.exe
      4⤵
      PID:1896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50165.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
    3⤵
    PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
    3⤵
    PID:16012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28257.exe
    3⤵
    PID:5496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
    3⤵
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48366.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        5⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4420.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56431.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
      4⤵
      PID:16268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17159.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
    3⤵
    PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
      4⤵
      PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52943.exe
      4⤵
      PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
      4⤵
      PID:18584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38261.exe
    3⤵
    PID:11248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2526.exe
    3⤵
    PID:14652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
    3⤵
    PID:17484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35761.exe
    3⤵
    PID:18504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52814.exe
  2⤵
  PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
    3⤵
    PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54286.exe
      4⤵
      PID:10548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
      4⤵
      PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
      4⤵
      PID:17436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
    3⤵
    PID:8876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
    3⤵
    PID:12872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36296.exe
    3⤵
    PID:16164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
    3⤵
    PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27719.exe
    3⤵
    PID:6348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47158.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47158.exe
  2⤵
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23436.exe
  2⤵
  PID:10180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32087.exe
  2⤵
  PID:13508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:16852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30967.exe
  2⤵
  PID:8120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3744 -ip 3744
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 9056 -ip 9056
1⤵
PID:7744

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe

Filesize
184KB

MD5
64a434161b51fa0fd7f16995e485784e

SHA1
d21fddf2c2ed74c89c36f924eedf9d19047d8e7d

SHA256
976f16368ebe3f85c1d703fc094a7253c3adde68309db833bbcad3710ccd82cd

SHA512
f96e1b23f43cfb27c15a73cab0861ecfd24d278fc7a54dc43151becdc0ea3cd52ff0dc3ea1e455eba4a05da3aad4b06e06b7c1e5189c28341866cc33906f62bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe

Filesize
184KB

MD5
23f86a41ed5a35b5ce4c45afdc78b11b

SHA1
8f484a258d3a27b34fa2eb34042bc39a0227de6a

SHA256
433c55921c253da68b3428fdf810a292227500333651c13ffda8c37542cd1353

SHA512
d51e9970138719b33aa728a3316ac5c3b6d58ded1bd0a22bf26832d8c1bc94d67c1dc5a709255ba72a492361b93b44a66463324176937e5334ddb301bcd7ffeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe

Filesize
184KB

MD5
af35269a4fad740dd178db97d5fc53dd

SHA1
237773b25d9f1e34341aa2f4f197d9e6c7fb62ad

SHA256
c92f3b78acd7520a5dfa89fb7bb7b9dd56f67108924bd57471fcbb7b00e6a0e8

SHA512
0c980c1cd9d79f2d6bb0d966af6430b03cadd3becf9504ee71cdb105b75abc9c78af17144c0aa95afaef23947e43a3cc3e620ffce029f15f72bf822effa95bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1790.exe

Filesize
184KB

MD5
136bbce95a90d93bbfd34c5b6fe18233

SHA1
83af44ab0f50d55414b7e71b4ebafcbdd7a4c549

SHA256
e518a541fdc7020a3e2588cc995ee3a0e41bed94008017b9d514946d9837485f

SHA512
ca0665566ff560260f7cd6b785fcb91df30646d98e59dc15c12207874c5641cf6e19b9fdac6b925389d1e3dd9b33e773ea229977bbc02c9dc337fb9875df6d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe

Filesize
184KB

MD5
f25dee8c14b7d714a62e54d45e9cf375

SHA1
b154d2a4d535f073adbf8766985fa5df2f849b9d

SHA256
f14c6bf65b596d20ce4a316cb15f786ca9e9deb2cf84098e20951ef368d30962

SHA512
698e85675a7a443b88dc43942e115015615e3840dd72a552af3a4ef0ac0a64915d79d157595e09c4384723405c4ded49db409ea89f66d80fe94bb58dfe6948ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23332.exe

Filesize
184KB

MD5
759a554b1aceec1369ec7ce71536fa9a

SHA1
b790c46c0135065f41587338d102e1a658c9e988

SHA256
4c14ab273512e2019f31791c64ca7b9811f82c5d3f55e0264bb2d2bdc67b3abf

SHA512
f76d22b26c3aadd7c9617613ba9503daa1221e19676cd6db0889a99fda969b2a0054f6e38fe2b89036314a7fc6e37b66199b20893fe858e962c1bd623f765867

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe

Filesize
184KB

MD5
34d4345a5e9ac09cb489142ec2d4532e

SHA1
aaa85f649fa8e5362de5b91402bc75ba0b5adf4c

SHA256
45554af229143a4e70005e8c9b63b129cab8554dc89ed2e8277670b52b576331

SHA512
0ef7cd2037969afae202541769b6da5c832619f8967a1592fb2e2488ad1ca02c6416c97c5ac3bbd957277fc3cc7e1579ebe9f9a1ea3e02ef60c28c0c832d3b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24382.exe

Filesize
184KB

MD5
21604ec49e43d14a0e1967c349e7b95e

SHA1
0df8e9ee1bf2ca59139e1ec044bd0b3d8c882432

SHA256
7674b89515c987a64f149707816ba762f5f864ae54cd4642f57e7e130861d7b1

SHA512
decc5b3a4ea7750cf8d7e232cceee9ef8b4d4215cd6addc7d7ac798f29041bc56c71c2e3cbb5df6a1f5a533543ad109000508c1a3f369c6a955feb6d62eff142

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe

Filesize
184KB

MD5
bb796eb9dcd45a72d3c1d479013892c2

SHA1
9db15c983fe45f50b77da5785ba26162a09335b6

SHA256
38084b54add83452344000690499804bea2d2574c5ce524b50d30e0cc1e42fa1

SHA512
ff843c210cbb7d0c9d1535bc5ea1736535556c73b0698d0798c8a7e73b2d4b3e26368530cdccdb47f573666f82fa9f4d9c956c46c4ae8f91f699f919bb2c03f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26670.exe

Filesize
184KB

MD5
b28ad66d874b0d3e598d0f4b5c7a33a2

SHA1
f830cbd3d59c858bcd68562111a609bedebc33eb

SHA256
08cea09cb50804158a41e81f69db5ec6046f75ed51f33066e6a1c372697c5f0a

SHA512
20007356846d888afc017c52747c907cd1051ca6928969084b429f140e124ed06bce7f70b1e07b481789b7bec9f464f8a32f60ff75f63189789ca6764121543e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27013.exe

Filesize
184KB

MD5
e153804010a9ee221140bc26d7192325

SHA1
00ad9e184f0695acfa58bb3c26e53db6461938ea

SHA256
5aa597c1a6a82fa79485f09ea2a40233fd95b6b84f8ee197d31eb734c9ca1569

SHA512
661cdc09c7473588dcdb55fae0fa2d29080893f6246b537f4b2ebde24c665e13995c7284911c1a6588903e39bf9bed4d9a7984d20b79f721fb06e168f04adda0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27470.exe

Filesize
184KB

MD5
d51cb94f2dc763f67ced86379efa1a07

SHA1
93bab9ee89a409bfff2d6d4341e205c0429922e5

SHA256
d58d778b4101fd8c2e8e47ec0fc5ea4adb57773a183a985272310f4d4fe636e4

SHA512
8d63500e7b14b0e00c7466ae3ce8cf15a788c44aa54c08cebf06107465c65a21cb994a27799d15e2083b040fa9fcdd68e81e693e354d02cf0b9a8b0db4d1c4a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe

Filesize
184KB

MD5
ebd3ff872064081113d0b4186fbd2931

SHA1
75070b0858deabd77f8554288c3a4ef10200b093

SHA256
fa6d7697c95bb3150ce13c7a10896f9cbcc07b16791f98eec38463d0e75e2592

SHA512
ae2428d324982d013f669d4f2fb32445e7cc11b5234113415fcbbe45be71f57a0b70ab962c836f9654a3d564ddf58ceb59fcb4cf6735f047508ce7f125c1cfa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3213.exe

Filesize
184KB

MD5
40703f806fd273af8ca88745b84e0ac0

SHA1
6467f790663ae6b2fcc062aefe551aa4e043e20c

SHA256
d69873d3c14a8c307b8158318fd1052ca944d5c31f62f1dfb71e1bf102dcb7dc

SHA512
8af3655a12eb2cd6173216ae5cc3dbe941452d70ec02c935f552e70967cc068d1d4212449319777bf0a7b65e42f142db975a28bd75bb48281d1316710a8c199a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34395.exe

Filesize
184KB

MD5
96f971e19755238416dcf9bc3eb419f8

SHA1
e98dd426b601af77fcfc7e5f4aa421792e513108

SHA256
c452a639226d8f2eb2d66661d2ec5e95d7ff6a75e25c60c450fc3f7a4462a5cb

SHA512
c301d6aaf6b60d9862059d1188765cbabc1d745b6204e3b0a9068729385560b8d1c46cc5da90cafe190d29e74cc58f2b0fb4f617143e8744be991e0362493cdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37068.exe

Filesize
184KB

MD5
1190be3cdd80c173edc8faedf5800320

SHA1
cee35849632bb18a631d961c59bcb6e41f6ca28a

SHA256
b18745935233d13a1564ca8098dd168e9d3d0bd6e43891ec4eb9cbea877145a8

SHA512
b0b844560ca2d5fd86234a3c91f1805febd66a6f89c733c406cf30c49488cede6f046d9349612d091d388491421ede54c839bba18045f89d61b17c3fe7e8d134

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41486.exe

Filesize
184KB

MD5
0ad9c7e886203c7b83c9a99ce64660cd

SHA1
29a4f24486acccf314f987f10a0896e5746143c1

SHA256
9bf673b6bef3e9453c185d43fd7a4b2cedc0459035d40dc859a7fda0b8bb4e8f

SHA512
ad3bb94fc3133fc4f0af81e97480146b606375833d760a0b1bbee200e47e195ddeec3cd1b8b0c26ac33ce496263078bf62c1483cd8381ebce2274adebff6906c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe

Filesize
184KB

MD5
175b284e6ca7ff321b06a9ca99cda044

SHA1
aa41c1d91d401b5b8fe9d48d66b01d7706aa53f1

SHA256
d337db21256c363dd28b45d9926359805254a0c10cf9c1c2d1c90ad7f2b8de39

SHA512
0d17df589d8f2aa331b7a4f0c20ad8e8e16fc2bbfdf8c6e634fa9abc3b11caaeff1d179a4ebf11951e8144fccd25a3bb4f7a99d94d2bf9b197164167c9b9556a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe

Filesize
184KB

MD5
ccc0cc2a9cf9927f5ad897813a8e8085

SHA1
8fa70651c67612bfcc9559398be166b60a8b2896

SHA256
ba282e22f5629ee4774f3f5c2d62b4a137d11e8ac7790bac2584b84c360f33ba

SHA512
e2e9af43b72086940f3dc6b35b26a7d882f56d0dba7491418dc049941b4685c0d3757e79ff4d0a2b3143f645d7cf092939ac59f2d3df685c0a9e2df33490015d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe

Filesize
184KB

MD5
05942eaefb2b61213a51eb07326ad703

SHA1
f6c0875b77dbb7cc52448176ba5d72c2e66aa456

SHA256
c8f37947934c8e17e3d54fadc14674f1f9c35ad4a37bfb2df33e305dbb0e5ab7

SHA512
130479833d7733ed13b7e00a37a6d26361fc69dc30c5877a29f551a74e6a47088afa17a466f1241c72209465853ec28c6ab0e60aecc27877f9fde23e66b2784a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54600.exe

Filesize
184KB

MD5
60a9f1c0e7fa239628780df3b7630962

SHA1
d52734837d1ebe81ea3ed950e6835ec9fd93ae53

SHA256
e6937a1bcb75a3cc1a18b7d404fb75b7b4bb34f730fba8e814e352c11de17e39

SHA512
016b1e6ef721547f85426bdac8e61e93871acde2139ef32baf4932c02925ec2e752266e8f9a78a7bb008b32eef602aabdaf2e8bff26e90c1a61c567f4c9ec229

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe

Filesize
184KB

MD5
ebdceab4dfc9ac78126b32f6c7739e35

SHA1
dcda71d4253bbf86ccaa37b3418e463c679ddab0

SHA256
fab499bc31ab81e5c9a6bf06e17c41036ec4f9c30322eb41a8f34f8a95be1509

SHA512
9ee644819c4136e2df5cde1c716cc5b86dedc8f1ab2d90159c95df86d574102d7948dae616d4bbd191d383c4132dbeff1dc2900a37bb087923d80b9217ea2004

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56350.exe

Filesize
184KB

MD5
1b7b1e97da065b425e676765ceae5187

SHA1
3371032a26bf86dd1e21a632ca28cdb923f34d80

SHA256
94c29ee9554dd5ec4cc1e0f8b32e25d426458524ab2b2f0d7e82c8d42678f324

SHA512
23babe1377234c25149e16868b2296e75915be37506dd0abc4cc3811519744ad5c380ac928dde4c29e0d5f7d7ef7138191eac011266ad31f1262762c4bf39fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56981.exe

Filesize
184KB

MD5
d5fc630eff9d8a946c2b682f5dcde30f

SHA1
a8adc2552f091e443f5c68f6a20e6890434814f7

SHA256
0133877f75c45c0dea1afc989c605c848075b007ea5c352a2b89855828989232

SHA512
93ac830cf7ccfb19787506723364765aa13738355709c9d5f382bfb68360e652291cd7cced6afd92bbd13bce3571d00f19659b5d474959f1c0ebdace5dc7770c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe

Filesize
184KB

MD5
89fee7b407ad1a05c09256526e87e9ae

SHA1
1513ff64f80df4f63f260ceaf52ce7614ded4703

SHA256
c22272276e221ba554c1cd758e9808e211fd8de943621417c3856a6a15a05308

SHA512
711e6a59faaae9459ea61e2c90ed0b263d15ec238f4014fd2f913e1e39cf90dc27156a04fdb8eb5813d7c9aa454b997c3045ed2531ea7e8457cc2d9fa3392617

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe

Filesize
184KB

MD5
10b483d82fa044f3b466add1d8010eac

SHA1
a308fcec98520a18ed826b5e1605ff1e6082087b

SHA256
caf678997a5e222cf6f852358df497160ac1944e99cd4b8da91730197afed248

SHA512
ce10e44408900787776f0c76fc733a380249c36307f7a7b22f588ccd4427886ca2315ce01463d8b954a8aae7b96094079897e902db18d088a37686a8ca0ccc49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe

Filesize
184KB

MD5
b5eee58ca1f4fac35bcb2a415541db4d

SHA1
2bf7fc4b646e3b10e83315fca865f8a3ad98916e

SHA256
413c4fd8a19b3720902ce5b3af4253ddd8752d99f21e6c77771123ace608fbe1

SHA512
94a306fa2dde00a27dba869bccb39f9b526d058c159d6e9596503cc67ce72e629e6c364a94357aeae72cbb065e8931e8e1270bfa1e8c7e95a522d2c08bff7293

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe

Filesize
184KB

MD5
cc5c5484fe1745cb75848eba694fb03b

SHA1
05abc28f2041069d54cf8f6d87546a7d625f939d

SHA256
86caf8aca3b17afd785c1caff3fe295ca694d1d4b4dc2aa45444ec97142f250e

SHA512
3882a58a85c0b7191d0a5333b1e7b9c83d3efaba6c4a37f69f1918f39341ad3cf1b9c8960f7f67568b4347457932cf1383331b90d3e5deeda7b86a382fd33510

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe

Filesize
184KB

MD5
fa93c28860cbda761b141907a34e4fe1

SHA1
881ddd31d316c8e80d57e5e02690d606f0c93433

SHA256
83e17de806de506751c1ef4669b40f0dba45cc485e9ca8fb1f579c232040ba6f

SHA512
6109f02f8b5466d75d28c4cecefe2a87c36cc208fee499687dbaa3257af944d2092342b93ee0f82e80668a0453847a6046988cec3f52bbb09ded1c368be7aa56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63790.exe

Filesize
184KB

MD5
d73e27e3013aa05cd65aa94ce28e5623

SHA1
814ca413490a027724709944e3aab818c9c21dc6

SHA256
268c7143614a6495bee4bdbbc187bfad71c41377cde9e6d4cdcf8a117923ec4c

SHA512
56f47075f489e1e9d3c69a9642085c39f751dd87bfefdf6ccd93867ee54cb9cf30ade07f704edfcd66ddca3eb4f1cbe852c3924442a33ce61b651772c67dc5a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6907.exe

Filesize
184KB

MD5
7cb407f01fb7a64d3d9ca6e18f74744c

SHA1
9d0d67e2f6a46e4e6744fc5d001cb46bc68166e4

SHA256
025e2a3e5713258c52e98556d328f3a0fb6af156325d10354cb4e0de67c43a8b

SHA512
48c31046ff83a2ee858100564c2ab1e23f6ee3ce84273897e619b1abe9cee84cd4b51424e735154c3171e2f5566a3f2dd78012a078fed6af660a359a6cf89be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe

Filesize
184KB

MD5
1e3c5ab70ec19992bf63b6be87965292

SHA1
2fd31f111e7d3b78a35ffef7e9047d889396725d

SHA256
4784bbd4aa1968eb69c5209d82f92364117c68eb469f74f23fbf578acca3aecc

SHA512
27a82ce335892e265e989ad40e291e9b9935f0052a75e4016e1fed2394c485e4109ba8d4e12c1eec3358bc1a1acef82fb13f23160a71581ba6929d47bcb861ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8253.exe

Filesize
184KB

MD5
273f4aa7b06e9505ba1553b36dc41b74

SHA1
16c5fceb84ffaf27b43e939fe4fc0a86dd7e885b

SHA256
d60d482513a2aa1a38685874870938659c60dfb975d444f96ad16764d3ea9c90

SHA512
044c557fd286e72eb4fbc56d1274c237f41b468a14d380985d3ffef27260497c7c1734ee05cd3b9d2f1fa3b4b1115a0f754c467c13cd4fefc290598d40ba2406

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads