7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daa

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe
Size 184KB
Sample240927-rcmrtsybrf
SHA256 7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daa
MD5 815faa16911fd468406e5234d0c6f220
SHA1 3ec78d421f6e65a5ca200f22e737bb4eaf14757a
SHA512 a2852a79b77982173d8131b94d501bb228a35d5016aa69e9adccf35f52f912ac3d436e0046e6f075e710bd51c19a4aa9e9071e2969c02947c7fd19eb0234a2c3
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtxlvnqXvGuc:Ys9oyXDnlqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1888	Unicorn-3062.exe
444	Unicorn-49907.exe
3332	Unicorn-30041.exe
3824	Unicorn-19695.exe
2812	Unicorn-40115.exe
5100	Unicorn-33984.exe
3896	Unicorn-28417.exe
4276	Unicorn-51547.exe
1444	Unicorn-39849.exe
2052	Unicorn-19067.exe
1104	Unicorn-27235.exe
388	Unicorn-22886.exe
4652	Unicorn-23151.exe
1140	Unicorn-11453.exe
4544	Unicorn-25188.exe
3668	Unicorn-57551.exe
3984	Unicorn-54406.exe
3948	Unicorn-29155.exe
3600	Unicorn-27108.exe
4768	Unicorn-13742.exe
4500	Unicorn-2045.exe
4896	Unicorn-50499.exe
2460	Unicorn-46415.exe
2040	Unicorn-54205.exe
4092	Unicorn-43269.exe
3188	Unicorn-55522.exe
4420	Unicorn-9585.exe
1304	Unicorn-11888.exe
3708	Unicorn-11962.exe
3680	Unicorn-61718.exe
1896	Unicorn-32937.exe
4532	Unicorn-28853.exe
3772	Unicorn-28853.exe
1872	Unicorn-52995.exe
2592	Unicorn-9532.exe
3660	Unicorn-19939.exe
3160	Unicorn-36010.exe
1756	Unicorn-56695.exe
1036	Unicorn-54318.exe
620	Unicorn-41319.exe
2200	Unicorn-41873.exe
976	Unicorn-61739.exe
4316	Unicorn-57655.exe
1292	Unicorn-2708.exe
2024	Unicorn-54510.exe
1080	Unicorn-49679.exe
4944	Unicorn-94.exe
3396	Unicorn-45766.exe
4632	Unicorn-6216.exe
2212	Unicorn-12346.exe
2388	Unicorn-7500.exe
4928	Unicorn-10300.exe
3932	Unicorn-28683.exe
2748	Unicorn-28683.exe
4996	Unicorn-7301.exe
772	Unicorn-32502.exe
1124	Unicorn-38963.exe
2696	Unicorn-23181.exe
3352	Unicorn-13882.exe
1628	Unicorn-32256.exe
1208	Unicorn-1822.exe
3204	Unicorn-14074.exe
2028	Unicorn-46747.exe
2412	Unicorn-40617.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3596	4944	WerFault.exe	135
900	4632	WerFault.exe	137
5544	3980	WerFault.exe	157
6592	4632	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20900.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe
1888	Unicorn-3062.exe
3332	Unicorn-30041.exe
444	Unicorn-49907.exe
3824	Unicorn-19695.exe
5100	Unicorn-33984.exe
2812	Unicorn-40115.exe
3896	Unicorn-28417.exe
4276	Unicorn-51547.exe
1444	Unicorn-39849.exe
1104	Unicorn-27235.exe
2052	Unicorn-19067.exe
4544	Unicorn-25188.exe
4652	Unicorn-23151.exe
388	Unicorn-22886.exe
1140	Unicorn-11453.exe
3668	Unicorn-57551.exe
3984	Unicorn-54406.exe
3948	Unicorn-29155.exe
3600	Unicorn-27108.exe
4768	Unicorn-13742.exe
4500	Unicorn-2045.exe
4896	Unicorn-50499.exe
2460	Unicorn-46415.exe
4092	Unicorn-43269.exe
4420	Unicorn-9585.exe
3188	Unicorn-55522.exe
1304	Unicorn-11888.exe
2040	Unicorn-54205.exe
3708	Unicorn-11962.exe
3680	Unicorn-61718.exe
1896	Unicorn-32937.exe
4532	Unicorn-28853.exe
3772	Unicorn-28853.exe
1872	Unicorn-52995.exe
2592	Unicorn-9532.exe
3660	Unicorn-19939.exe
3160	Unicorn-36010.exe
1756	Unicorn-56695.exe
620	Unicorn-41319.exe
1036	Unicorn-54318.exe
2200	Unicorn-41873.exe
1292	Unicorn-2708.exe
976	Unicorn-61739.exe
4316	Unicorn-57655.exe
2024	Unicorn-54510.exe
1080	Unicorn-49679.exe
4632	Unicorn-6216.exe
2212	Unicorn-12346.exe
3396	Unicorn-45766.exe
4944	Unicorn-94.exe
4928	Unicorn-10300.exe
3932	Unicorn-28683.exe
772	Unicorn-32502.exe
4996	Unicorn-7301.exe
2388	Unicorn-7500.exe
2748	Unicorn-28683.exe
2696	Unicorn-23181.exe
1124	Unicorn-38963.exe
3352	Unicorn-13882.exe
1628	Unicorn-32256.exe
1208	Unicorn-1822.exe
3204	Unicorn-14074.exe
2412	Unicorn-40617.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1888	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	82
PID 3880 wrote to memory of 1888	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	82
PID 3880 wrote to memory of 1888	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	82
PID 1888 wrote to memory of 444	1888	Unicorn-3062.exe	83
PID 1888 wrote to memory of 444	1888	Unicorn-3062.exe	83
PID 1888 wrote to memory of 444	1888	Unicorn-3062.exe	83
PID 3880 wrote to memory of 3332	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	84
PID 3880 wrote to memory of 3332	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	84
PID 3880 wrote to memory of 3332	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	84
PID 3332 wrote to memory of 3824	3332	Unicorn-30041.exe	85
PID 3332 wrote to memory of 3824	3332	Unicorn-30041.exe	85
PID 3332 wrote to memory of 3824	3332	Unicorn-30041.exe	85
PID 444 wrote to memory of 2812	444	Unicorn-49907.exe	86
PID 444 wrote to memory of 2812	444	Unicorn-49907.exe	86
PID 444 wrote to memory of 2812	444	Unicorn-49907.exe	86
PID 3880 wrote to memory of 5100	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	87
PID 3880 wrote to memory of 5100	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	87
PID 3880 wrote to memory of 5100	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	87
PID 1888 wrote to memory of 3896	1888	Unicorn-3062.exe	88
PID 1888 wrote to memory of 3896	1888	Unicorn-3062.exe	88
PID 1888 wrote to memory of 3896	1888	Unicorn-3062.exe	88
PID 3824 wrote to memory of 4276	3824	Unicorn-19695.exe	91
PID 3824 wrote to memory of 4276	3824	Unicorn-19695.exe	91
PID 3824 wrote to memory of 4276	3824	Unicorn-19695.exe	91
PID 3332 wrote to memory of 1444	3332	Unicorn-30041.exe	92
PID 3332 wrote to memory of 1444	3332	Unicorn-30041.exe	92
PID 3332 wrote to memory of 1444	3332	Unicorn-30041.exe	92
PID 5100 wrote to memory of 2052	5100	Unicorn-33984.exe	93
PID 5100 wrote to memory of 2052	5100	Unicorn-33984.exe	93
PID 5100 wrote to memory of 2052	5100	Unicorn-33984.exe	93
PID 3896 wrote to memory of 1104	3896	Unicorn-28417.exe	94
PID 3896 wrote to memory of 1104	3896	Unicorn-28417.exe	94
PID 3896 wrote to memory of 1104	3896	Unicorn-28417.exe	94
PID 3880 wrote to memory of 388	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	95
PID 3880 wrote to memory of 388	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	95
PID 3880 wrote to memory of 388	3880	7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe	95
PID 2812 wrote to memory of 4652	2812	Unicorn-40115.exe	96
PID 2812 wrote to memory of 4652	2812	Unicorn-40115.exe	96
PID 2812 wrote to memory of 4652	2812	Unicorn-40115.exe	96
PID 444 wrote to memory of 1140	444	Unicorn-49907.exe	97
PID 444 wrote to memory of 1140	444	Unicorn-49907.exe	97
PID 444 wrote to memory of 1140	444	Unicorn-49907.exe	97
PID 1888 wrote to memory of 4544	1888	Unicorn-3062.exe	98
PID 1888 wrote to memory of 4544	1888	Unicorn-3062.exe	98
PID 1888 wrote to memory of 4544	1888	Unicorn-3062.exe	98
PID 4276 wrote to memory of 3668	4276	Unicorn-51547.exe	101
PID 4276 wrote to memory of 3668	4276	Unicorn-51547.exe	101
PID 4276 wrote to memory of 3668	4276	Unicorn-51547.exe	101
PID 3824 wrote to memory of 3984	3824	Unicorn-19695.exe	102
PID 3824 wrote to memory of 3984	3824	Unicorn-19695.exe	102
PID 3824 wrote to memory of 3984	3824	Unicorn-19695.exe	102
PID 1444 wrote to memory of 3948	1444	Unicorn-39849.exe	103
PID 1444 wrote to memory of 3948	1444	Unicorn-39849.exe	103
PID 1444 wrote to memory of 3948	1444	Unicorn-39849.exe	103
PID 3332 wrote to memory of 3600	3332	Unicorn-30041.exe	104
PID 3332 wrote to memory of 3600	3332	Unicorn-30041.exe	104
PID 3332 wrote to memory of 3600	3332	Unicorn-30041.exe	104
PID 2052 wrote to memory of 4768	2052	Unicorn-19067.exe	105
PID 2052 wrote to memory of 4768	2052	Unicorn-19067.exe	105
PID 2052 wrote to memory of 4768	2052	Unicorn-19067.exe	105
PID 5100 wrote to memory of 4500	5100	Unicorn-33984.exe	106
PID 5100 wrote to memory of 4500	5100	Unicorn-33984.exe	106
PID 5100 wrote to memory of 4500	5100	Unicorn-33984.exe	106
PID 388 wrote to memory of 4896	388	Unicorn-22886.exe	107

C:\Users\Admin\AppData\Local\Temp\7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe
"C:\Users\Admin\AppData\Local\Temp\7fef2dba48e0a1ea872619c7bc19568df733bd7021a6c14155e526e6d5ef8daaN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49807.exe
        9⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57918.exe
        9⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        9⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24450.exe
        9⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        8⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        6⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39643.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39681.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31232.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39802.exe
        7⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
        7⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
        6⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13429.exe
        7⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8594.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        6⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        6⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        6⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30191.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24600.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        7⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        6⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        7⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 628
        6⤵
        Program crash
        
        PID:900
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 640
        6⤵
        Program crash
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48558.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6397.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        7⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7748.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        6⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36855.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36385.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47795.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        5⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54484.exe
        5⤵
        
        PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53050.exe
        8⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        8⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        8⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        7⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        7⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        7⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        7⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18920.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        6⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        8⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        8⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53881.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        7⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        7⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        7⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37783.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        6⤵
        
        PID:14612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        6⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        6⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55661.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        5⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45665.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        6⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41283.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59361.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        7⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        7⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        6⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        7⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35153.exe
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40310.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        5⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41231.exe
        5⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2414.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        7⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
        7⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50257.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49025.exe
        6⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54474.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        5⤵
        
        PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2693.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59547.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50554.exe
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60208.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56191.exe
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49616.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30073.exe
      4⤵
      PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46415.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58003.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        8⤵
        
        PID:17460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47842.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32372.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        7⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1713.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45315.exe
        6⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35087.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27067.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        8⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        8⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51862.exe
        8⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17673.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        7⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21609.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34654.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56481.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        7⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        7⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        6⤵
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
        6⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5413.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        5⤵
        
        PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        6⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9313.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52040.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62339.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37305.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16705.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21143.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26483.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10310.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        7⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16729.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        6⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29532.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16413.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28914.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63793.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10782.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2557.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43309.exe
        7⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        6⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        5⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1789.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57110.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3294.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59646.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50781.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        5⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        5⤵
        
        PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35619.exe
        5⤵
        
        PID:864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        5⤵
        
        PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4445.exe
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27951.exe
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
      4⤵
      PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      4⤵
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51511.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46.exe
        8⤵
        
        PID:18076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14593.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47674.exe
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53773.exe
        6⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        6⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38033.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62087.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19283.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48340.exe
        7⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16460.exe
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        5⤵
        
        PID:16548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        6⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26992.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4129.exe
        5⤵
        
        PID:17620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46143.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7985.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        5⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46533.exe
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
      4⤵
      PID:15392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
      4⤵
      PID:18268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 724
        5⤵
        Program crash
        
        PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17110.exe
        5⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51873.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        5⤵
        
        PID:14596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56646.exe
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
      4⤵
      PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
      4⤵
      PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
      4⤵
      PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7500.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
      4⤵
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2562.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5821.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41801.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        5⤵
        
        PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54910.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30850.exe
      4⤵
      PID:12476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49009.exe
      4⤵
      PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64555.exe
      4⤵
      PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      4⤵
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
      4⤵
      PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
      4⤵
      PID:6208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3118.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19625.exe
      4⤵
      PID:18120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26788.exe
    3⤵
    PID:10020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28241.exe
    3⤵
    PID:14252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52249.exe
    3⤵
    PID:16920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26162.exe
    3⤵
    PID:6316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38963.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7710.exe
        10⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2417.exe
        10⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        10⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        10⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        9⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        9⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        9⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        9⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        8⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        8⤵
        
        PID:18132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        8⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        8⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44665.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60005.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1633.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        7⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23181.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54059.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        8⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        8⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57030.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36749.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        7⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14852.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        7⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2733.exe
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42309.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2554.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13882.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60433.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        8⤵
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63801.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        7⤵
        
        PID:17396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28546.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        7⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        7⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        7⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        7⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        6⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        6⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5361.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37045.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31253.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23778.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        6⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59883.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        8⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23728.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        7⤵
        
        PID:3792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61962.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        7⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        7⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49333.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45266.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14025.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62995.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        7⤵
        
        PID:17548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        6⤵
        
        PID:18172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50425.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:17420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30302.exe
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35536.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
        5⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9532.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10509.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        6⤵
        
        PID:17692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24244.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37237.exe
        5⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        5⤵
        
        PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47442.exe
      4⤵
      PID:3980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 644
        5⤵
        Program crash
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6069.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29829.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        6⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61306.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17969.exe
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        7⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        6⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50383.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34565.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-177.exe
        5⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19859.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50346.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33920.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36581.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55957.exe
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3361.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21093.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33616.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60662.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18402.exe
        6⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28107.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4208.exe
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57290.exe
        6⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1480.exe
        6⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        5⤵
        
        PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        5⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22080.exe
      4⤵
      PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        5⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        5⤵
        
        PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        5⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5448.exe
        5⤵
        
        PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60233.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62663.exe
      4⤵
      PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
      4⤵
      PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        5⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13797.exe
        7⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        7⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51330.exe
        7⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5176.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8293.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23367.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        7⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10045.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        6⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
        6⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62405.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50974.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31541.exe
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48610.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63077.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
        5⤵
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
        5⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11026.exe
        5⤵
        
        PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34280.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        5⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
      4⤵
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
      4⤵
      PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
      4⤵
      PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18049.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44098.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17332.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2850.exe
        5⤵
        
        PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        5⤵
        
        PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35921.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15198.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35665.exe
        5⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        5⤵
        
        PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        5⤵
        
        PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29646.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51498.exe
      4⤵
      PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61890.exe
      4⤵
      PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35424.exe
    3⤵
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36903.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        5⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54062.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33414.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35597.exe
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28302.exe
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41141.exe
    3⤵
    PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
      4⤵
      PID:17424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
      4⤵
      PID:8748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20394.exe
    3⤵
    PID:6464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
    3⤵
    PID:12496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22673.exe
    3⤵
    PID:16232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        6⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62967.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        8⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        7⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
        7⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29585.exe
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30570.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57546.exe
        5⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30235.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18073.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41601.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        6⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10680.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        6⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34578.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25458.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10752.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25279.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17333.exe
        5⤵
        
        PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22067.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56697.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        5⤵
        
        PID:17776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11853.exe
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52226.exe
        5⤵
        
        PID:764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18624.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57886.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      4⤵
      PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
      4⤵
      PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        5⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58883.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12977.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        7⤵
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20824.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14707.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        5⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8345.exe
      4⤵
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38265.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
        7⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        6⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
        6⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43181.exe
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        5⤵
        
        PID:17876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54799.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-725.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20672.exe
        5⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28530.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22184.exe
      4⤵
      PID:12460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32473.exe
      4⤵
      PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
      4⤵
      PID:6320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26263.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28788.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
        5⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24628.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
      4⤵
      PID:13524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
      4⤵
      PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
      4⤵
      PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
    3⤵
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10481.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
        5⤵
        
        PID:15928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13397.exe
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51464.exe
      4⤵
      PID:18264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12700.exe
    3⤵
    PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43697.exe
    3⤵
    PID:9948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22434.exe
    3⤵
    PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
    3⤵
    PID:17200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
    3⤵
    PID:8368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57655.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        5⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39747.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        7⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56124.exe
        7⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        6⤵
        
        PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        5⤵
        
        PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
        5⤵
        
        PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      4⤵
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42487.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13516.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39226.exe
        6⤵
        
        PID:18196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41601.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20900.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        5⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28413.exe
        5⤵
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
      4⤵
      PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
      4⤵
      PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
      4⤵
      PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
      4⤵
      PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        5⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16921.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5540.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        6⤵
        
        PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44918.exe
        5⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        5⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2320.exe
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      4⤵
      PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:15984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        5⤵
        
        PID:18160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26714.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
      4⤵
      PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55582.exe
      4⤵
      PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
      4⤵
      PID:11460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30248.exe
    3⤵
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14482.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62666.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4824.exe
        5⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        
        PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28965.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57866.exe
      4⤵
      PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3141.exe
      4⤵
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41018.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10886.exe
      4⤵
      PID:12656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
      4⤵
      PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41170.exe
      4⤵
      PID:7396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
    3⤵
    PID:9804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5369.exe
    3⤵
    PID:13676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
    3⤵
    PID:17140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
    3⤵
    PID:7564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60699.exe
        6⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63661.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33817.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50065.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6501.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        5⤵
        
        PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10701.exe
      4⤵
      PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6598.exe
        5⤵
        
        PID:12428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38337.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
      4⤵
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59498.exe
      4⤵
      PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8729.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24587.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        5⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5128.exe
        5⤵
        
        PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4373.exe
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5261.exe
      4⤵
      PID:16896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57414.exe
    3⤵
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29880.exe
    3⤵
    PID:13544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
    3⤵
    PID:16632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2858.exe
    3⤵
    PID:9320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20811.exe
    3⤵
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49451.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9350.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20201.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        5⤵
        
        PID:18092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
      4⤵
      PID:14876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
      4⤵
      PID:17468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
    3⤵
    PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4970.exe
      4⤵
      PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10325.exe
    3⤵
    PID:10824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
    3⤵
    PID:15324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23973.exe
    3⤵
    PID:18124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48783.exe
  2⤵
  PID:4020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
    3⤵
    PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42443.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9713.exe
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10496.exe
      4⤵
      PID:8376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38617.exe
    3⤵
    PID:8808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
    3⤵
    PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
    3⤵
    PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49947.exe
    3⤵
    PID:7548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
  2⤵
  PID:6384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58779.exe
    3⤵
    PID:8628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26049.exe
    3⤵
    PID:11972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58633.exe
    3⤵
    PID:432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55946.exe
    3⤵
    PID:18400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2328.exe
    3⤵
    PID:5060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
  2⤵
  PID:8568
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64674.exe
  2⤵
  PID:16260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
  2⤵
  PID:8172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4944 -ip 4944
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4632 -ip 4632
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3980 -ip 3980
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4632 -ip 4632
1⤵
PID:6292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11453.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
Size 184KB
SHA256 01988b2261935ebd25d2f8a548846197b0fd6a1d9dabb8dcc8a4e11069585e55
MD5 487c8a4d8af130135aed459916c5b37a
SHA1 ba22ed65f797823ddd2d174c925ebf08b54b4e9e
SHA512 4104d0d21441d1920cfcf3ad5e435f1188213996b946b12c848b30f77144c60bc18c4a81ca0bfac551a336791908e49e51dfed3d26ed1c3f5060530e3c0d767f
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHt/lvnqXvGuy:Ys9oyXDnlqIt/lPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11888.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11888.exe
Size 184KB
SHA256 c5c2f09f6bfb0f909419ff7376d3fbd0016510f11633ef965845bcff848e062e
MD5 ae2f4897341516c488a365976b19bb14
SHA1 fdcd0dcc16be03f02496ce8c8889a79d79e328cf
SHA512 746b2fe4d3ca2b83fd7b1348f6bff1eec578290ecbc7b23103673a20416dcb3fe953819790febcec77fe96685111b527d9f5559e8fd329a2ef41b6260298840b
SSDEEP 3072:msmB8Jo2JjH9ZDn9rjPqGHtUlvnqXvGuy:ms9oyXDnlqItUlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-11962.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11962.exe
Size 184KB
SHA256 538b7a60f8b3863fa69755d0b075c9fbf1a7a5090366cdd0add932ba8d2f4b46
MD5 e095c951cf5306c0037dcd5d2234fe05
SHA1 835759f875eeda6eb2ca46f1d2d084d799c6b78f
SHA512 500cebeb0a89ce4cc43d45a82a6d97af2b363a7614526b2ab3792cdb933234b0cf25c389f4e78557f2b7d36b72fbf58fbd2677b3bc6399f2de438ab1135b6532
SSDEEP 3072:Ysm68Jo2JjE9ZDn9rjPqGHtGlvnqXvGuc:YsGoNXDnlqItGlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13742.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13742.exe
Size 184KB
SHA256 ab4451af6addd458a4a77b91fb0ce880228143bd1a317ddd540fbb3cc48cb464
MD5 29825a6e825a73938bf24833023e20ad
SHA1 07a3e942e4c46f39ff97ab5af878e69ece86f879
SHA512 32e1f6ff038d033cb5b89c535428d7c0bf9414baee1a2030218aedb6303cfe775b6e3bf5921534aab2f293a17a38ae92750d055cc60b06dc2943dba3b5adc7af
SSDEEP 3072:YsmB9Jo2JcH9ZDn9rVPqGHtxlvnqXvGuc:Ys8otXDnzqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19067.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
Size 184KB
SHA256 83c77620bf50b1a0b25b6fb42711d4f782708a8c10e185362c39e91a8a42fe8a
MD5 cfb10e7cc5711ff20ca515f6871c9e94
SHA1 3f74f770bdac91a6402dcae821a93ee9d7f2b142
SHA512 e20bac27a5179290b99ce346daf532cefd3373ed2dc4d9b8f167ef680e8500bfebc502c679fcbfbfef64abd9d43c69722e2c74032ba51840afccb4f71ac77293
SSDEEP 3072:YsmB8Jo2JcH9ZDn9rVPqGHtxlvnqXvGuc:Ys9otXDnzqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-19695.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
Size 184KB
SHA256 2d3514056ea05efa1a3de26dca835fdd190541f47a1539b331196ccbe19e3afc
MD5 be39ecd1c6c4c1a74369a129c1063cb0
SHA1 bbdeca0354026071ce1200d86cfcaeb403ebff1d
SHA512 4b8fc05f7743fdcda8a73e5d08d2afbce9a817f67d3c83f2f52cc4ce8db985246be8f0aada1968b5d35dfb9c6a56cdc11470d838f40b57d26a6cf833e217104b
SSDEEP 3072:YsmB8Jo2JjE9ZDn9rjPqGHtrlvnqXvGuc:Ys9oNXDnlqItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2045.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
Size 184KB
SHA256 876c2e88176109b94a94c07a83fed3389f51c0586006cd2c2f421257755fbf9b
MD5 b1956ce4bb62c543908f9c06b09b0440
SHA1 ef4df18274ec15c0c1ab05d532538f3bfff00bff
SHA512 fb110b497092b12323f88625cb3fe03c16290ced7e0d3ca9500f30595524d9223729094f729816e1480847260949011893a81b152e8194808267ddf090c8046f
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rVPqGRtxlvnqXvGuc:Ys9oyXDnzqGtxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22886.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22886.exe
Size 184KB
SHA256 038db6eba20f61520f0bc54c45150a4cdb6a5be317ebd047d1e3112bc3141254
MD5 ca52e9538a85ad8a8737907ede524939
SHA1 a5093667776a66dc0b2d8c6d277a89c10bb72a49
SHA512 d941ad0aa64cc64e310d4d8287a04cbec79ad59a61d1bdc861db4c754590e47fa5ec4c525b1dc5dc0b52df2470b91ea8826411fd6f6560187070d29673c16a7e
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtHlvnqXvGuc:Ys9oyXDnlqItHlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-23151.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-23151.exe
Size 184KB
SHA256 4476fc56a0f9560ea68d572247376e931c8f54000c6734ec85a28e353b8fe96a
MD5 dbebc0ec9b4bb7c1a997b238b06c1c26
SHA1 045a0fd713e35a7c4e909b2ea7699f5376178b8b
SHA512 8549f71a9c2d6d3132caa533f4924d48855e34f5172a0144c8413b9eade08fc75f1030bbb1a3accf6f6c45e4775c2ae8ddc6aef2154fd9dd4a4816ebdbb2fd01
SSDEEP 3072:YsmB8Jo2JjH9ZKn9rjPqGHt+lvnqXvGuy:Ys9oyXKnlqIt+lPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25188.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
Size 184KB
SHA256 15bb9cab1619fd68f2c92294c8e5af78d7848dbaf9414fb674e2c0c8d99512b7
MD5 55aa32dd2760181a681739054970cc72
SHA1 fd04dedb2e0918a05aa1662e847a2e389ccdf47f
SHA512 11e61cb4e91d72d5408c81212324281ad8fada0546d5bd171bde6732b3b8891e95a0fe06f874333431223d6ed84511d91ca6a3012d8da54901a7a793df416c82
SSDEEP 3072:YsmB8Jo2JoH9ZDn9rjPqGHtxlvnqXvGuy:Ys9otXDnlqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-2562.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2562.exe
Size 184KB
SHA256 59a377a229a168a01f81acd8fd4c5221bba68733131a515cda1df7b9b9088fc7
MD5 4535e8983991a32ac9c7dcc157a94f8b
SHA1 5838098f532b4fd9293e593cf39b952f374890b6
SHA512 8ec976b2cf0020f05fb439ef551a4d54c81c4021090efe3c575de1662726a358521f452ecd47f6d7bf440cdef5cd88d9f0dc85f24fcb3c14fab684486aec350e
SSDEEP 3072:xskB8Jo2vjH9ZDn9rjPqGHtxlvnqXvGuc:xs7o4XDnlqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27108.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
Size 184KB
SHA256 c6016b064ba19c924cc8feb3218be09831c76b55a735acf083368a904d691168
MD5 7a5bba35f2a2aa5d602464d13b44bcbf
SHA1 e9ea70e6b7e0360fd9bd2517ea59e40064cd8a60
SHA512 63c8f69db5896f6810b1bdd56ce29a625c625cc7cdbeee46ecb948296bf0565ac924c6bec058658dc8c736119093b119cc789115b6617044665bb16cb3fa18ba
SSDEEP 3072:YsmB8Jo2JjHCZDn9rjPqGHtrlvnqXvGuc:Ys9oyKDnlqItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-27235.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-27235.exe
Size 184KB
SHA256 745245d9fd28d1e70e8dcc1b765b31e91f58dccc4170fcc151c36c8318ac6565
MD5 1def18a44c208be6753f7103d32c9cd9
SHA1 a805ed2c78fecff8572e354256658f74c2c0d5c1
SHA512 63137ca3371ea6ec6931b178efc28a98763c9073a20ee8db31c626f1372d6a2dc42a5ce2543940263f40e3336716e7606a66fb4f27e9fefe6ba36f976d879ebf
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rnPqGHtYlvnqXvGuy:Ys9oyXDnpqItYlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28417.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
Size 184KB
SHA256 7ef92e05a6269c1905bc846459a97c078611cf2770d9f1b95b92730ceea614e0
MD5 37669bb492464a0c279a9583df255f3d
SHA1 5de190a1696c47b033f9f08b775b18d68268f9f8
SHA512 b9d92e16ae6d4622fa7f71ef93b7c2053e6673b90014050a55ed6595029dcbf3e11a719f13e54ec41d88bb64eca0efe578663dfdc863617fbab0b797dd63568a
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtYlvnqXvGuy:Ys9oyXDnlqItYlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28683.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28683.exe
Size 184KB
SHA256 22eca26bc5baa10594e999d8d8629b6fd567babc993f588d28ab79b018288864
MD5 c25e5ed49076dbb270859232bbfbc82d
SHA1 6c7a5b47b556ffa6e7c9e082e9a760a7f1feb7a7
SHA512 c3c6de069f78c81f83cab85d413903139794e70b63bcf661709a88e8367966cdff04c97db9a7ded6497e3e31037f98e299d4ffa5f1ddefad95029ec3631ad299
SSDEEP 3072:msmB8Jo2JjH9ZDn9rNPqGHtUlvnqXvGuy:ms9oyXDnrqItUlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29155.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
Size 184KB
SHA256 ed2e468c8cf1bf731108b6349677378d4b8f26fbca75751bde5648e53b9577f6
MD5 f1bd957466209846daee95b534815dcb
SHA1 c7d6a20117405be3728bf3bfffe295d7587a7a47
SHA512 dfaa9f1f5378725c4931b95fbdbdd64568bd30bb9f54dac051aaabb3e89fec7de613c9c717fc68a2fe6da40f04cf649596da3b85c62a57f638e7f600a207e754
SSDEEP 3072:AsmB8Jo2JjH9ZDn9rtPqGHtrlvnqXvGuc:As9oyXDn7qItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-30041.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
Size 184KB
SHA256 87a668a5f59b44c2e6b69052368486024f048d725bb96516edf898145e2ebafc
MD5 86d3a0799778bd07ea0e564201d7a655
SHA1 21ddccddb47e1334654a7bd7e0351569bf74521c
SHA512 450b47ea52cb6afede404496e9b8c5088c27d888eb8e0d777d82f345300af946e787ba64aa9194fee383e2c03c0c4177b3e8feb90d64da3b1faf44cae90d9ffb
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtrlvnqXvGuc:Ys9oyXDnlqItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3062.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
Size 184KB
SHA256 bb69ba8f803b108427ab29f3aaf8853c040130ba07d43be58cbd8a4c7205788a
MD5 0fe8f4ad0e2479748011c69155e26bf2
SHA1 86b7dbf68d82d462b6de8264747c0784e93da614
SHA512 f75d60fe42412cd6178c153710f640bfe39038d73ec74f00f1014721295b0129f1d0ddd039ec370851148264ac17cd9acad47183a13a05d96115b38308a4c1c0
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtxlvnqXvGuy:Ys9oyXDnlqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32937.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32937.exe
Size 184KB
SHA256 dc62685cffa93ebf28f4cae64c95324441c5e8d936fb3fe47a94da323d8b1de0
MD5 d679043142076e52afb2db011722df5f
SHA1 e00277b9d375cf9c6eb47fc254da012b4c85157e
SHA512 d045f2c5dca8280beee03e78900d460796312c4f628ed154f5021e97edbc6ce902c99179d20ef7bb6b209af0cf0b76e93b87af3431f855c89f1c72cecb4c5105
SSDEEP 3072:YsmB8Jo2JjH9ZKn9rjPqGHtzlvnqXvGuy:Ys9oyXKnlqItzlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-33984.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
Size 184KB
SHA256 1eee69551339af5185c4055132d24bbf567983ec87a8be3d49553e3347ca7aaf
MD5 9bd2ee1734547b2f4cc97289147ed89d
SHA1 65be55ddf49f2afdfad877c7fe24f0ebea89d76d
SHA512 de9da2401d0587b48937feb686757d1655b2232888f4f793e6de0d7034f095ea4b28998a6bc684ddd3adb9940825e7f9b022e0afa33a6fe4dcbc68c73e2036ca
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rVPqGHtxlvnqXvGuc:Ys9oyXDnzqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39849.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39849.exe
Size 184KB
SHA256 7bda2d0858a01a6d062c71c1cf1bf9c78dae454fa765487d070a28f1d0a36b9c
MD5 5ce8db8c603e3e88a76b09b94009ca42
SHA1 c9d025d3cc4c1afe9a809a25e05957959cbf569b
SHA512 a8c6d9e7b42402a141586ece98dc97b91e04390dcded7e34d5747830b69934269164b82580d334d19f6d30f710b7dca87a217457a6e160b08f23a978f15ba89a
SSDEEP 3072:AsmB8Jo2JjH9ZDn9rjPqGHtrlvnqXvGuc:As9oyXDnlqItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-40115.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
Size 184KB
SHA256 6f1f681e0fca81def14c7712461645b407bc8c203dfaae388d4b5636d111d6da
MD5 aab601a263905a3b604dfb0d8505b1c0
SHA1 a0857a694822619931612cd8a975367222ab92d7
SHA512 7b19fc951b09eb72bca5f9069c6cf555a8871f1835039948149fef681867a1e3ea7c4e472c92ed04dec25015b2e1d028b593b7a6e735abe8d4ddc1fafda5eb76
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHt+lvnqXvGuy:Ys9oyXDnlqIt+lPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43269.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43269.exe
Size 184KB
SHA256 a8bb8adfc8aa5548935842f4a5f15b58a3d743fad0b870268a4885d8fcd3687f
MD5 7ffd754392c2974359466b0fff6a3faf
SHA1 ea8050a07dde9853a13a82f61d4ae9951a27dfe8
SHA512 18bf469e3a86217509c88c996f6d89bce1cf508acc0432d7ace722fb8e9206f8d3a90f8bd30a62f4dba1066d2b9e6e8b71ef75396adc2a80e44e15a3fef1242b
SSDEEP 3072:YJmB8Jo2JjH9ZDn9rjPqGHt+lvnqXvGuy:YJ9oyXDnlqIt+lPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46415.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46415.exe
Size 184KB
SHA256 7d24c2e96f89e71f48bfecf35a061f1e8ff43b3c55a2ac7b247b1e32cb39e61f
MD5 6809a30d6f8cc720247cb2f2fc88fb44
SHA1 730833a7a82ca90d61d471b037163a9041eb1135
SHA512 c7054139fbd28341fd20b940863689e2c19308dbcf79e6670fee176aea185719ac3870254d0e8c7a80006f3822f4c5d8c59bdfbdc7b17065dfc0ab4e50cbaae4
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rnPqGHtZlvnqXvGuy:Ys9oyXDnpqItZlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47487.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47487.exe
Size 184KB
SHA256 6c7b0afe6bfd291a327f865a245250e8342a1cc879e94947e7c1e0b5979fcaf4
MD5 57cf48d5bff90d3096598e783a695f35
SHA1 dd8172a49f6ca2181ea3c7297fe16c4b631f3f45
SHA512 f7fdb85af6f5810fbc482b96203a698ee3df5d4f55a10abe6944946f73ca22cecdeb0a5b06bae4f911a5aa23f518d9f403a698eae0df22923be5df8781d58706
SSDEEP 3072:9sIB8Jo2JjH9ZDn9rjPqGHtVlvnqXvGuc:9sHoyXDnlqItVlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49298.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
Size 184KB
SHA256 00d5955aed622626a20cdffe9c16b22021f39bbf601659dd1743aca17df57d6c
MD5 b14eddb3c532870871335dc224c0d515
SHA1 55c32dc586fda89b5af5c5f9cb55d9905430dad7
SHA512 2282b4948646e3a8a8743fe7e1ede6d265698767244b950b565260eb09fd96778a6c5030308ddf885521c238d476846325fe39b2ebed3172fbc1ee763982a3a4
SSDEEP 3072:ssmB9Jo2JoH9Z/n9rjPqGHtilvnqXvGuy:ssootX/nlqItilPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49907.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49907.exe
Size 184KB
SHA256 862f4232f633a64894486d0f59f6f1cefcc36688f3cd307059821144cbb03cc3
MD5 724dfb7df3080998aad7cbccb3c941cb
SHA1 a29ac76649dea4164fe3fa009577991744479012
SHA512 5c0bb087d090b3ad39315356b6568ac8f4099e4b51fb3721acd19dc3b5f109aa6657a541025bd7c2f2e521e6dc798c7a125780b6628bdf3c7d8b05c4af5d8faf
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtUlvnqXvGuy:Ys9oyXDnlqItUlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50499.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
Size 184KB
SHA256 4cc8ed3dd4ee1a776c4b9f9e54d6845778f3bd28de5e62559d6ce197e6f9de89
MD5 8d465537def55e04e92c156102052500
SHA1 daccc3bad5c4892f1d253c6641cac68229a6f02e
SHA512 ec9b75436e859db46b9be30a6f67eeacb498505e8de1989ae4cabfd325a22538f17b7c81b120710e9caa867326b9c49d89d910f136b27f2c23141dad93491d7f
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtZlvnqXvGuc:Ys9oyXDnlqItZlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51547.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
Size 184KB
SHA256 d70f6a01fde452b97fc04e5e8f543444f1dcb3d4de60860442e80262b921e3e0
MD5 26f60001bfa4669caaa450dff904e4d5
SHA1 9535704a7e9c5eee1693e64393392313aebae235
SHA512 076528fe97cde39e94adadf58bb14526ca33869a64a177090da5b77b1ac42fab6742f66c23789367f1c196165d050f049188777ad0eaa036edf1270707657dc6
SSDEEP 3072:YsmB8Jo2JjE9ZDn9rjPqGHtclvnqXvGuc:Ys9oNXDnlqItclPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54205.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54205.exe
Size 184KB
SHA256 97a60d623e8d6f438321ff01ca970955db9ccdd4d519bae59596592bc2101703
MD5 077b6ece0588c28cfa1ee5d747f1dc20
SHA1 6a6bbf206116a9f1986c3ce1974ae5f846b71df7
SHA512 e81202c0055c738e6517414e02429638da8a1135a91c87c03c6d5473153ef9807cb617b7645e3e65d18c47600264cae45eb64b7f21ab18cf7eb8bc027116937a
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rjPqGHtxlvnqXvGuc:Ys9oyXDnlqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54406.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54406.exe
Size 184KB
SHA256 c0c81869eddb9e4dc5ae9458df697c18769ead287dd5888e21a35c2d69814ce1
MD5 7a0cd32411bf655b61200723d430b13b
SHA1 54522fa0c78eb48ed0a5d2fa6d40f8619fb31873
SHA512 34920cf347dbd102ebaecbea7ec6a539e4a9073290b51d4ddf424b33e80552c269ec8bd09619fb08b15e530104329c621d3f1176e0ce33235ed4e80aed335707
SSDEEP 3072:YsmB8Jo2Jj99ZDn9rjPqGHtrlvnqXvGuc:Ys9o0XDnlqItrlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-55522.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
Size 184KB
SHA256 172c2ad1b3dfe3e7d7f1c7703ca9c712c25957d49473186b0c3b7810a4348b48
MD5 7232b5c7113c5701f65a3bc05ba57b72
SHA1 42940123a66ca09d0ead20a31f9a77a0b1cbd2f9
SHA512 c13f45b8289a75af508c693376cd67883ce48d2e91003025de7d7cd6ede4d8fb1ea0f397fdac01802edf93418acd5cdaae18779d97abc96d6b814eb4b2435801
SSDEEP 3072:YsmB8Jo2JjHfZDn9rjPqGHtYlvnqXvGuy:Ys9oyxDnlqItYlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56695.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
Size 184KB
SHA256 abebc16ec0883e889557afdd673ba4c4e54e3712d5a980d1c7fb640bd18e21cc
MD5 6273bb24ec669507b6b3eba06103e9a1
SHA1 72cb4c469b91f32534d9f3ea0cb6ddf3697fc5a7
SHA512 1485b062b55e36209cb8853913d90ae5db208329fc7355ed7a3727da66c0f9d0df207df11c9a70b6d227c88a1ab6c7eb3b82b4961b7509515d1b720abb3800ad
SSDEEP 3072:AsmB8Jo2JjH9ZDn9rtPqGHtPlvnqXvGuc:As9oyXDn7qItPlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57551.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
Size 184KB
SHA256 9d7b0ae07a36a22499b0ee5c56da55d6c9c0ad6bc31b24af93ccfbcb8e064b4e
MD5 9d6a9107a432c1fa54f6fe271a3c98d5
SHA1 c8016813ab7350a7df38a385f0122fed3a444cbb
SHA512 30c61acd506f2c46b02065565f01c9179806632964b6ba10fd1d51569739af05291979fac65d1aeed007ab85ab602343899056d94cc740efcd0a6d0fd20d8e58
SSDEEP 3072:YsmB8Jo2JjE9ZDn9rjPqGHtGlvnqXvGuc:Ys9oNXDnlqItGlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-61718.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
Size 184KB
SHA256 e10d89226dc965fbbfa191139922fc6a13ba5b3b6f396d1017f5ff9a22169eeb
MD5 210dc90ba317ff24ecc965d964e3802f
SHA1 94c3d5cfc9fb95bd63d94b9ef1aad4d4db94993a
SHA512 458da46394546772d1624b439167871fa31e3a7474f7986a3b619131b5d747b88d2b1aa259fc8aed2895368abbd8ba684f4179d6ee214897ac8347f5d8508dda
SSDEEP 3072:YsmB8Jo2JjE9ZDn9rCPqGHtclvnqXvGuc:Ys9oNXDneqItclPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9585.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9585.exe
Size 184KB
SHA256 df1acb6c1d874319353f9a792b2465ce990868e897da82c524beb264457d0079
MD5 6bd1de605ff761f553f65d66e0deb165
SHA1 b3be0467432dea5af5df181f8f798d7dcc963e65
SHA512 37f5f77776926e5ff1c733cf99c47e833ac33cbfc682a03f42094cb975ec7b3e6d190f0ee40c17c55c2389d785655c00844be3271f7fea038d3ab2881070783d
SSDEEP 3072:YsmB8Jo2JjH9ZDn9rzPqGHtxlvnqXvGuy:Ys9oyXDnVqItxlPqXvGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads