d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801

Analysis

max time kernel
119s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe
Size

468KB
MD5

08954d42775e2b0dbd220ab5b46b92f0
SHA1

4422ed3e0b9de5e88d5682aa7371d24156b8464e
SHA256

d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801
SHA512

f06d1155b9a1baa18cea3083fae9a66d9ee3435550db9fb7eb31af4a8a0bb3df4fff7b4c5c74eeb3faa841ff1cbe6b09e56c6b6b32bde239dc6e7d15e546b699
SSDEEP

3072:E3mCogKOjZ8UFbY+Pz3yqf+/Iphm4XpTGmHxDlFm40u+f2EN0zlj:E3ro+KUFtPDyqf75fC40peEN0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1984	Unicorn-50919.exe
2184	Unicorn-47838.exe
4664	Unicorn-60484.exe
4244	Unicorn-34529.exe
2204	Unicorn-36314.exe
4752	Unicorn-16448.exe
4812	Unicorn-62965.exe
5092	Unicorn-25042.exe
4860	Unicorn-42971.exe
4884	Unicorn-7657.exe
5076	Unicorn-37092.exe
732	Unicorn-17226.exe
3576	Unicorn-30961.exe
3524	Unicorn-37092.exe
1516	Unicorn-47346.exe
1916	Unicorn-29138.exe
4876	Unicorn-18774.exe
1732	Unicorn-38640.exe
4288	Unicorn-35049.exe
2768	Unicorn-38992.exe
3560	Unicorn-49928.exe
4700	Unicorn-5088.exe
1524	Unicorn-13780.exe
3612	Unicorn-35306.exe
1020	Unicorn-60660.exe
640	Unicorn-42067.exe
3448	Unicorn-34523.exe
2084	Unicorn-8274.exe
1504	Unicorn-13280.exe
2956	Unicorn-21707.exe
2564	Unicorn-16466.exe
2808	Unicorn-10299.exe
936	Unicorn-45811.exe
5020	Unicorn-11746.exe
3100	Unicorn-17877.exe
2280	Unicorn-39667.exe
4720	Unicorn-38971.exe
2028	Unicorn-40180.exe
3696	Unicorn-26444.exe
1356	Unicorn-14042.exe
4596	Unicorn-54114.exe
3128	Unicorn-52693.exe
2904	Unicorn-33354.exe
1636	Unicorn-55782.exe
4808	Unicorn-18654.exe
4528	Unicorn-18654.exe
4712	Unicorn-61777.exe
1120	Unicorn-38384.exe
4436	Unicorn-32253.exe
2432	Unicorn-40667.exe
3512	Unicorn-30470.exe
2220	Unicorn-54102.exe
4408	Unicorn-12509.exe
2488	Unicorn-28394.exe
4556	Unicorn-40248.exe
2108	Unicorn-60114.exe
3460	Unicorn-36549.exe
1792	Unicorn-45480.exe
3620	Unicorn-45292.exe
1004	Unicorn-62527.exe
3392	Unicorn-15189.exe
976	Unicorn-16856.exe
2428	Unicorn-61426.exe
4360	Unicorn-16720.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1076	1916	WerFault.exe	106
4124	1916	WerFault.exe	106
7208	6228	WerFault.exe	244
8368	6688	WerFault.exe	253
11032	1788	WerFault.exe	162

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21754.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13426.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1924	dwm.exe
Token: SeChangeNotifyPrivilege	1924	dwm.exe
Token: 33	1924	dwm.exe
Token: SeIncBasePriorityPrivilege	1924	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe
1984	Unicorn-50919.exe
2184	Unicorn-47838.exe
4664	Unicorn-60484.exe
2204	Unicorn-36314.exe
4812	Unicorn-62965.exe
4244	Unicorn-34529.exe
4752	Unicorn-16448.exe
5092	Unicorn-25042.exe
4884	Unicorn-7657.exe
4860	Unicorn-42971.exe
3524	Unicorn-37092.exe
3576	Unicorn-30961.exe
732	Unicorn-17226.exe
5076	Unicorn-37092.exe
1516	Unicorn-47346.exe
1916	Unicorn-29138.exe
4876	Unicorn-18774.exe
4288	Unicorn-35049.exe
2768	Unicorn-38992.exe
1732	Unicorn-38640.exe
3560	Unicorn-49928.exe
4700	Unicorn-5088.exe
2084	Unicorn-8274.exe
3448	Unicorn-34523.exe
3612	Unicorn-35306.exe
1524	Unicorn-13780.exe
1020	Unicorn-60660.exe
640	Unicorn-42067.exe
1504	Unicorn-13280.exe
2956	Unicorn-21707.exe
2564	Unicorn-16466.exe
2808	Unicorn-10299.exe
936	Unicorn-45811.exe
3100	Unicorn-17877.exe
2280	Unicorn-39667.exe
5020	Unicorn-11746.exe
4720	Unicorn-38971.exe
2028	Unicorn-40180.exe
3696	Unicorn-26444.exe
4596	Unicorn-54114.exe
1356	Unicorn-14042.exe
4528	Unicorn-18654.exe
2904	Unicorn-33354.exe
1636	Unicorn-55782.exe
3128	Unicorn-52693.exe
4808	Unicorn-18654.exe
1120	Unicorn-38384.exe
4436	Unicorn-32253.exe
2432	Unicorn-40667.exe
3512	Unicorn-30470.exe
4712	Unicorn-61777.exe
4408	Unicorn-12509.exe
2220	Unicorn-54102.exe
4556	Unicorn-40248.exe
2488	Unicorn-28394.exe
2108	Unicorn-60114.exe
3460	Unicorn-36549.exe
1792	Unicorn-45480.exe
3620	Unicorn-45292.exe
976	Unicorn-16856.exe
1004	Unicorn-62527.exe
2428	Unicorn-61426.exe
3392	Unicorn-15189.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 1984	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	86
PID 5028 wrote to memory of 1984	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	86
PID 5028 wrote to memory of 1984	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	86
PID 1984 wrote to memory of 2184	1984	Unicorn-50919.exe	89
PID 1984 wrote to memory of 2184	1984	Unicorn-50919.exe	89
PID 1984 wrote to memory of 2184	1984	Unicorn-50919.exe	89
PID 5028 wrote to memory of 4664	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	90
PID 5028 wrote to memory of 4664	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	90
PID 5028 wrote to memory of 4664	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	90
PID 2184 wrote to memory of 4244	2184	Unicorn-47838.exe	94
PID 2184 wrote to memory of 4244	2184	Unicorn-47838.exe	94
PID 2184 wrote to memory of 4244	2184	Unicorn-47838.exe	94
PID 4664 wrote to memory of 2204	4664	Unicorn-60484.exe	96
PID 4664 wrote to memory of 2204	4664	Unicorn-60484.exe	96
PID 4664 wrote to memory of 2204	4664	Unicorn-60484.exe	96
PID 1984 wrote to memory of 4752	1984	Unicorn-50919.exe	95
PID 1984 wrote to memory of 4752	1984	Unicorn-50919.exe	95
PID 1984 wrote to memory of 4752	1984	Unicorn-50919.exe	95
PID 5028 wrote to memory of 4812	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	97
PID 5028 wrote to memory of 4812	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	97
PID 5028 wrote to memory of 4812	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	97
PID 4812 wrote to memory of 5092	4812	Unicorn-62965.exe	98
PID 4812 wrote to memory of 5092	4812	Unicorn-62965.exe	98
PID 4812 wrote to memory of 5092	4812	Unicorn-62965.exe	98
PID 5028 wrote to memory of 4860	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	99
PID 5028 wrote to memory of 4860	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	99
PID 5028 wrote to memory of 4860	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	99
PID 2204 wrote to memory of 4884	2204	Unicorn-36314.exe	100
PID 2204 wrote to memory of 4884	2204	Unicorn-36314.exe	100
PID 2204 wrote to memory of 4884	2204	Unicorn-36314.exe	100
PID 4244 wrote to memory of 5076	4244	Unicorn-34529.exe	101
PID 4244 wrote to memory of 5076	4244	Unicorn-34529.exe	101
PID 4244 wrote to memory of 5076	4244	Unicorn-34529.exe	101
PID 4664 wrote to memory of 732	4664	Unicorn-60484.exe	102
PID 4664 wrote to memory of 732	4664	Unicorn-60484.exe	102
PID 4664 wrote to memory of 732	4664	Unicorn-60484.exe	102
PID 4752 wrote to memory of 3524	4752	Unicorn-16448.exe	104
PID 4752 wrote to memory of 3524	4752	Unicorn-16448.exe	104
PID 4752 wrote to memory of 3524	4752	Unicorn-16448.exe	104
PID 1984 wrote to memory of 3576	1984	Unicorn-50919.exe	103
PID 1984 wrote to memory of 3576	1984	Unicorn-50919.exe	103
PID 1984 wrote to memory of 3576	1984	Unicorn-50919.exe	103
PID 2184 wrote to memory of 1516	2184	Unicorn-47838.exe	105
PID 2184 wrote to memory of 1516	2184	Unicorn-47838.exe	105
PID 2184 wrote to memory of 1516	2184	Unicorn-47838.exe	105
PID 5092 wrote to memory of 1916	5092	Unicorn-25042.exe	106
PID 5092 wrote to memory of 1916	5092	Unicorn-25042.exe	106
PID 5092 wrote to memory of 1916	5092	Unicorn-25042.exe	106
PID 4812 wrote to memory of 4876	4812	Unicorn-62965.exe	107
PID 4812 wrote to memory of 4876	4812	Unicorn-62965.exe	107
PID 4812 wrote to memory of 4876	4812	Unicorn-62965.exe	107
PID 4884 wrote to memory of 1732	4884	Unicorn-7657.exe	108
PID 4884 wrote to memory of 1732	4884	Unicorn-7657.exe	108
PID 4884 wrote to memory of 1732	4884	Unicorn-7657.exe	108
PID 4860 wrote to memory of 4288	4860	Unicorn-42971.exe	109
PID 4860 wrote to memory of 4288	4860	Unicorn-42971.exe	109
PID 4860 wrote to memory of 4288	4860	Unicorn-42971.exe	109
PID 2204 wrote to memory of 2768	2204	Unicorn-36314.exe	110
PID 2204 wrote to memory of 2768	2204	Unicorn-36314.exe	110
PID 2204 wrote to memory of 2768	2204	Unicorn-36314.exe	110
PID 5028 wrote to memory of 3560	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	111
PID 5028 wrote to memory of 3560	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	111
PID 5028 wrote to memory of 3560	5028	d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe	111
PID 3576 wrote to memory of 4700	3576	Unicorn-30961.exe	112

C:\Users\Admin\AppData\Local\Temp\d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe
"C:\Users\Admin\AppData\Local\Temp\d1701562d590d8eab00ab4fe2cae467e198a9caf0d2680bfbcba86ac34f38801N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44507.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        10⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        10⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        10⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4167.exe
        10⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        9⤵
        
        PID:17416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52642.exe
        9⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        9⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        8⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59684.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62795.exe
        9⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3914.exe
        8⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57865.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62003.exe
        8⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15807.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26946.exe
        7⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33354.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25065.exe
        7⤵
        
        PID:788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        9⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        10⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
        9⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        9⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35366.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        8⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        8⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        7⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42194.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1106.exe
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        7⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40240.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14042.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6615.exe
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        8⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23747.exe
        9⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        9⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        8⤵
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44113.exe
        8⤵
        
        PID:12412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45191.exe
        7⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6650.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        9⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        9⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4354.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        9⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        9⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61249.exe
        9⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64373.exe
        7⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35288.exe
        6⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        7⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6228 -s 632
        8⤵
        Program crash
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38990.exe
        7⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        7⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2203.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        6⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19665.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12532.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36579.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19309.exe
        6⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11611.exe
        6⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47736.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42938.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        9⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        9⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        8⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48835.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48749.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-185.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24873.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18737.exe
        7⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        7⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37297.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        6⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        8⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        7⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37197.exe
        7⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17696.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10942.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        6⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        8⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        8⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        7⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48991.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49864.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44197.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        6⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5564.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12346.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53710.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56510.exe
        6⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        5⤵
        
        PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60114.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65186.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15480.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        8⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44474.exe
        7⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15937.exe
        7⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46009.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29531.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        7⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55749.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8324.exe
        6⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55738.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
        6⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22782.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55250.exe
        5⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        5⤵
        
        PID:12156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        7⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        7⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22366.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4522.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        6⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        6⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15312.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        5⤵
        
        PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        5⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45477.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        6⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20586.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29215.exe
        5⤵
        
        PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45034.exe
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
      4⤵
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16856.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62900.exe
        9⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        9⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        9⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        8⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        8⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47420.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35623.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4498.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61426.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36565.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27694.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56874.exe
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32387.exe
        7⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15562.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        6⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        6⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        6⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        6⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56877.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        6⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        9⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        9⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        8⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        7⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
        6⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6688 -s 720
        7⤵
        Program crash
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        7⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        7⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14503.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65442.exe
        9⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        9⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        8⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60875.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48757.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38332.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37798.exe
        5⤵
        
        PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32253.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52531.exe
        6⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        7⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        7⤵
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60075.exe
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        5⤵
        
        PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        6⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        7⤵
        
        PID:17580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        6⤵
        
        PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        5⤵
        
        PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39765.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        5⤵
        
        PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59605.exe
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
      4⤵
      PID:16736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15172.exe
        5⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        6⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57601.exe
        8⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20015.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12808.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        6⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54102.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20045.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54155.exe
        7⤵
        
        PID:17968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16431.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54979.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        6⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        6⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        5⤵
        
        PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52949.exe
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      4⤵
      PID:5052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12509.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
        6⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12929.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        6⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        6⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64524.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14663.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22051.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17640.exe
        6⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        6⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24834.exe
      4⤵
      PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        5⤵
        
        PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
      4⤵
      PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        5⤵
        
        PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30470.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32960.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        6⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4778.exe
        7⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        6⤵
        
        PID:15884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5784.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        5⤵
        
        PID:16540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-609.exe
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        5⤵
        
        PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
      4⤵
      PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
      4⤵
      PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29625.exe
      4⤵
      PID:11820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19087.exe
      4⤵
      PID:15924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
    3⤵
    PID:11164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2028.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
    3⤵
    PID:16288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60484.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29394.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        9⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        9⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
        9⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 724
        8⤵
        Program crash
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        8⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12121.exe
        8⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21706.exe
        7⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
        6⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17505.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33912.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16287.exe
        8⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13789.exe
        8⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55729.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11505.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        8⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        8⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39998.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27921.exe
        7⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13783.exe
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52009.exe
        6⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41449.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58854.exe
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        8⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        8⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55508.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37723.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9262.exe
        7⤵
        
        PID:17476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53951.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        6⤵
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16337.exe
        6⤵
        
        PID:13508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45542.exe
        5⤵
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37394.exe
        8⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        7⤵
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3536.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2027.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        6⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        7⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50450.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        6⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63883.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61872.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19762.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        8⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        7⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54690.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12593.exe
        6⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23723.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6400.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        5⤵
        
        PID:12816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        5⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3940.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        7⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        7⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7441.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        6⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        6⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        5⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43211.exe
        5⤵
        
        PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35531.exe
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30087.exe
      4⤵
      PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
        5⤵
        
        PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59425.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18654.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53178.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        9⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        9⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        7⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5299.exe
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39178.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17335.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        6⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28312.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        7⤵
        
        PID:18016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59937.exe
        7⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        6⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21307.exe
        6⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1866.exe
        5⤵
        
        PID:16308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19944.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47558.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        5⤵
        
        PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38926.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20180.exe
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
      4⤵
      PID:16192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27150.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7525.exe
        7⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17681.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62409.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64395.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9395.exe
        5⤵
        
        PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        5⤵
        
        PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40739.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40626.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39380.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61691.exe
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21981.exe
        5⤵
        
        PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45378.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40667.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24768.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
        6⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42034.exe
        5⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19401.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24537.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35081.exe
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24664.exe
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        5⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        
        PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46807.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
      4⤵
      PID:14748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17144.exe
    3⤵
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26456.exe
      4⤵
      PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        5⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        6⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40068.exe
        5⤵
        
        PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
      4⤵
      PID:15564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
    3⤵
    PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11117.exe
      4⤵
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
      4⤵
      PID:16036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
    3⤵
    PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 716
        5⤵
        Program crash
        
        PID:1076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 724
        5⤵
        Program crash
        
        PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44268.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16052.exe
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        8⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42013.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59058.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        7⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        7⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        6⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34881.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60670.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9277.exe
        7⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38289.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        5⤵
        
        PID:17032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24704.exe
        5⤵
        
        PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40399.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36714.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37920.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        6⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62562.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23238.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13894.exe
        6⤵
        
        PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16086.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        5⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10603.exe
        5⤵
        
        PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29938.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16040.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        6⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7561.exe
        5⤵
        
        PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15057.exe
      4⤵
      PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11873.exe
        5⤵
        
        PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
      4⤵
      PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
      4⤵
      PID:12260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2019.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30421.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55541.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40622.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27329.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19735.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51891.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        7⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
        7⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        7⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16916.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23641.exe
        5⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36082.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26116.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        7⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54546.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49102.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
      4⤵
      Executes dropped EXE
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28858.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        7⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29623.exe
        6⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61385.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        5⤵
        
        PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37377.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61626.exe
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42522.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      4⤵
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
      4⤵
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50377.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42667.exe
        7⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        6⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4122.exe
        5⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64185.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36918.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62545.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51016.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        5⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16357.exe
    3⤵
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21229.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        5⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33451.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48511.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63574.exe
        6⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        5⤵
        
        PID:16508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
      4⤵
      PID:17996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
    3⤵
    PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18127.exe
      4⤵
      PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14598.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56340.exe
        5⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        5⤵
        
        PID:12144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34613.exe
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
      4⤵
      PID:18068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1344.exe
    3⤵
    PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19710.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
      4⤵
      PID:2468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30960.exe
    3⤵
    PID:13012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37613.exe
        5⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24953.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exe
        7⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19149.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55500.exe
        6⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34478.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33580.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34346.exe
        6⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64715.exe
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48617.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33016.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51186.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35188.exe
        5⤵
        
        PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35808.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61343.exe
      4⤵
      PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
      4⤵
      PID:10936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20181.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3575.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26332.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60985.exe
        6⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17402.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        5⤵
        
        PID:12496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27692.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64051.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65289.exe
        5⤵
        
        PID:17304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13088.exe
      4⤵
      PID:15504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14848.exe
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36128.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        5⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        5⤵
        
        PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33071.exe
      4⤵
      PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29910.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2186.exe
      4⤵
      PID:15704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38053.exe
    3⤵
    PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56889.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
    3⤵
    PID:10208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
    3⤵
    PID:16984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17877.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25575.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11458.exe
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58928.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15163.exe
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16836.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53564.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15613.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48123.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12132.exe
        5⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        5⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44095.exe
    3⤵
    PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14797.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
        5⤵
        
        PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4761.exe
      4⤵
      PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
    3⤵
    PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35067.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
      4⤵
      PID:12936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32353.exe
      4⤵
      PID:12904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54720.exe
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14881.exe
    3⤵
    PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16817.exe
    3⤵
    PID:15964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32602.exe
    3⤵
    PID:13536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54114.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
    3⤵
    PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30132.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
        6⤵
        
        PID:17884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65345.exe
        6⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        5⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10201.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12314.exe
      4⤵
      PID:15120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28987.exe
    3⤵
    PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5352.exe
        5⤵
        
        PID:17296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7989.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
      4⤵
      PID:16612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
    3⤵
    PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61064.exe
      4⤵
      PID:17484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
    3⤵
    PID:12344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
    3⤵
    PID:16748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12578.exe
  2⤵
  PID:5220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7874.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
      4⤵
      PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53620.exe
      4⤵
      PID:13008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21754.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56898.exe
    3⤵
    PID:17976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32221.exe
    3⤵
    PID:10840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
  2⤵
  PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
    3⤵
    PID:9324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10254.exe
    3⤵
    PID:14220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12570.exe
    3⤵
    PID:15128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
    3⤵
    PID:16056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
    3⤵
    PID:3852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17671.exe
  2⤵
  PID:11208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
  2⤵
  PID:14788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50773.exe
  2⤵
  PID:15424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1916 -ip 1916
1⤵
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1916 -ip 1916
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6228 -ip 6228
1⤵
PID:7332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6688 -ip 6688
1⤵
PID:7880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1788 -ip 1788
1⤵
PID:9440

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10299.exe

Filesize
468KB

MD5
aa2b3442e12f11e1d966f11a9933c255

SHA1
5c502a3b2bf07e7fae88f964101c9607965cc568

SHA256
2b9a9cd96b4c2f904bcb6be327ee6f5ca04daadfa8050fa3e0c06a3a47d94eae

SHA512
8f02493bce8cfc53c5e6c86a540f8e7d209441616e729886fa133ddad011f8ff9e28d74d5d9b431c4c2edd1ea5d159127c3503176821a15d8b2afcb5784289a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe

Filesize
468KB

MD5
bf2430562ad5c063d764a6ac0dbf16be

SHA1
624f8fe5803298a45aa3ed4bd625969983f0e75d

SHA256
3967334bc87dccab0971a8a307d0f3cded726733658d2ce40892cddeda4bccc2

SHA512
67778f28ce93cbfede7a07575e5c86c7d6507d8461af984c81f34427660d6ad8acd46cba3cee1b2c5edb351c88d2d3cb6b4d9caed0173d9194b217b5e66a3b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe

Filesize
468KB

MD5
c37e969fa6ce808cc6de50f9479d4509

SHA1
44dd41d9db20d4d330f54f15bcebe6559737006c

SHA256
c14fea73322a5348c934890d1f9c36bacc49ff5a4d619bcae56c795693c6041c

SHA512
b60c4a908599dc140ac63d5af9c79980dbd1e27685de20e63bed497d235de70a031975b0606fb87db5842de5d96d6124642b722c8c1b0a156447fedf9a403856

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe

Filesize
468KB

MD5
15945cc7ba62162fefc1735c1449c129

SHA1
2b391a8dba5c2ac985ba3361c894aa048ea8c6f2

SHA256
ca9709c5b3c547f89cf7f14f802eb50d7af6394c541399f906881a8db1873cfa

SHA512
9606070e668674a66d998c8899de1cf57cda73cd11e091fa485831c414c7177713c1bc53a62ba358cc1e47bd5150876b386648698f0de171349d620c9afa3d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16448.exe

Filesize
468KB

MD5
52d80a4dd12ea0d59a5dc9c430421409

SHA1
83b86e895d8285b1cce099ffe41b3c39c76c60f2

SHA256
339ece1716d9a96fc696b864de794355f523bc081bcfade842e4de27a51b5042

SHA512
48c6be7af4e6c550e6b7510e54091ecb5d12c6ce155f799bf3683372c2c2610f8e8313d72029fcc5619fa4f9d34de0ac5b5c3bf69979ad1f67deda8f37ed6150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16466.exe

Filesize
468KB

MD5
5d25deabde14fe715175c2bb75d8d4d6

SHA1
276c17bcac5c355078435deae39bf99852aad044

SHA256
c53cedede1481c1265bbe5b6aba766827d1cb1f4b4e0a0d28577b86d0badf828

SHA512
dd6ed8494a0dc264964973de0ea5c1e53d1ea8b0e87a2eadbb59e8403cff553570f7dd4dc8571165cffc403927eee56001b455b19fcd2cc48cfd5f6aeb3cce04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17226.exe

Filesize
468KB

MD5
928fe33cf6fd927fbe7b54364c68074f

SHA1
d2fea9acfe6f0130951876dfeec2e6e607b76ea4

SHA256
22498eb8f96980a89ce4b5830ed62813ab4acb48619b74327aa5579dc1086d7a

SHA512
a46c69ea63eec5095962e08af341d434d91bf0de0faa07520e3c533d90e1716d2529af7faa5b673a769000037aa14058a6250456305ac10270e937170f303a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe

Filesize
468KB

MD5
7f7278ec337c0b61fd4bc9d421a8234f

SHA1
943c7a1fda80d0f2cb0bfc68a7162d1838503440

SHA256
27787b56fa0e5a5eab56e4f538ab19abc8c3dbb58eb3f521df1bc70252c13b73

SHA512
02af200f26b5aff28378505fb1c69ec2ff05c88eef2854c3466b3906326d474c4e1e203e37f01ab0cc6cc7b5b6524a18c393b9bf79985b2e14785a53eff3cc7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21707.exe

Filesize
468KB

MD5
6adebcc30c9ad06910f97d7d2b2b527d

SHA1
a7f3e11ee44554d88219f32abce7ed79a6145907

SHA256
dad5815a7f1b483959bf0eb17913c73cd3ec362e6f53ba9a263fe723e5599818

SHA512
e229630a6eaa12842c342e49a5b59b2cf779014ab7fe8355a6002c1b5ecc870a9a7cad340fbe20fc4786e453e393c26605cda3996e862ff638554cf41d685ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25042.exe

Filesize
468KB

MD5
9aaec18aa7445a31ab713a3c906a7d3c

SHA1
b91db80f24d767b3312eef436aa5b0a3613d5df1

SHA256
33f10ff1d5f00e8fab8eafeabfe34df568be75c4448fb10b747e9aace1b00529

SHA512
8b1c5a76848b0c6394fe78248e7d59a84f25f45b2f75657e4a0379315dece416f3ad5bd355e672ec4ef28f43191cc60ee416f0d7d57716189a91b49099baea87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe

Filesize
468KB

MD5
ad0d0a479c08fc7a7758a3b0c489ecbd

SHA1
97d58687ccb4b8c5730f4e9abb392b3d0f914cfa

SHA256
aa1e0fddb4c21847590bf21fb6f20262492689ed23a0ab26df312c07b2fe5829

SHA512
19ddf7221aa49915de70a4e8604bc1ae386aca45579c444edadc3a5a627e52d5b1d68d5a84355f64394b3f9a0c186f29f5b58823d1c8edf464df5acad9e78fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30961.exe

Filesize
468KB

MD5
5fa174f81d5e45a1fccbbcb7b45b24b1

SHA1
a23b8730cdd2ab790be3af40c56f46a14683fafd

SHA256
a525fe34a4a83dcabf970fc2412f67ae2d4da468dd327003eaf3c1322404171c

SHA512
d2503b98e873abe35fec0034a6e518fed16f59b1341ed11b2cf5a32cdb2a27df14032048f56edd1f30e6a706a0e05dd7d3c16557343c90c8b39f2cf5009537bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34523.exe

Filesize
468KB

MD5
06d0ee9adb654228dd6e072750f894c3

SHA1
643385f4682f755ea6fa683cf2c9a11bb3c95c20

SHA256
e2642a8e141c0943d21db77a5984515e135b3167b34fef97306c1ce12b004acb

SHA512
85df01cbf19c1b45374b35caa3f1f7f3ca792ec55839060a16fde0263bd3ea3a66aa3eba3dd839a4fa725ec4ba6c3b84ea873865bc0c4ac7b8284d0c01c0f4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34529.exe

Filesize
468KB

MD5
386508c4d205a246afaeb83132889b43

SHA1
669dbfe750b79d2d1336e265d104972251c1dac7

SHA256
3a6cdeed49da440112ba4a76f4a6ab45ab1a4f9b8fad29436d9c25d47996117b

SHA512
4f2a57cca482f7ffe56f9fa2d26cb73a1651234be3ee0f0c8d468ce0f89178037f5127cf8eda9354de53caa5e1642336680be00904370baad5dad1aa0b6703a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35049.exe

Filesize
468KB

MD5
6fbec4be9be466e281a094ab5a712662

SHA1
c06bea3b09d341f27a5e9c994fd7026141955196

SHA256
4d9949c8dfff8a3048a03c5665a439a8077c1d89bd3f42b2090ec93a6b940f35

SHA512
3bb126bf0f90558849bff46b7bb2e58178a5882a23b4953018c2d19e39914a5c4fea1fe4a335a599cb66798087772e23a3082ea10de866d9cdbc1863f61958cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35306.exe

Filesize
468KB

MD5
f31ac91f73618899199c3c69e9e167c1

SHA1
fae6bbbb475e1cbb831776bfb92dad68d7fec8ee

SHA256
68abdf42babd7fb685c6f8806cdf48b934b5b0d03dab00b6c3ab967aac899340

SHA512
9dd91d997c4fad4cdd17eeaba53b11dab682ebabddd2afc713b89cc846e2cb0259f825ca22834dcf3cd1d848f43f7424f22abcf8f1f08a95bc43c400634c3bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe

Filesize
468KB

MD5
1ec2ff446b48c3611208b48c1dde8866

SHA1
0d8d179a5d95358de3edd67bed1032104e11c67b

SHA256
66ae1491ad404ae03d873b8faad0aafc10811aa82edfbcabd9484cc577021e35

SHA512
956a06392bb7b427556000c5f5f852ed9fb956bbe717bec2dbbf1ea9cd80dc3296cf0ee92e01d83f3f2816d8d3a0f61e925d2aaeefb42d066b7e92ed8ea0fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37092.exe

Filesize
468KB

MD5
c2c24941fa5e7da88a6588bd6bf4bd54

SHA1
f04a48003f616ab050f945f8bfbac358a2463078

SHA256
2ccc412b919829983c633e9bf85a3c26a63f7bf468b33fd0e331f76b0c6e0da8

SHA512
4a8d66c5fb15fd7482ade97029b639ffd9cfc5e7f597342adda1786ec6a78c11eef700d67fbbc05111426bcb35306b776302bb389bed10056c3ca4a76c217b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38640.exe

Filesize
468KB

MD5
7eac5b9290763f29ee026dea80d75782

SHA1
19aba22349b7b34d9c30bd389fe465a8f1cd0579

SHA256
58ab25963539c343bfa94a53b2339d9fd75ccdd5dd8d38d41394fbf6df03c365

SHA512
ef1cec0dab3bde722bac16f3ceeb063e33c665f42cc3de4e3f9f4bbdb2c7b8620e6066452b3d63ac63ded4bee7b9e82e4abe1a2222efbdb4063db71cf229c14c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38992.exe

Filesize
468KB

MD5
8e6b234fe6f4e0a3c66e69b53a36b164

SHA1
63e9a2500e56ddedf132a72f85bc066634a2f280

SHA256
73830a94f7799c10b988ea694a36b2e1a7f15486b651592a82ddc68f4081b759

SHA512
5abbcd58d1cbea91325984fb5b9af74c1d794481f4322e94995723478babc41c44761ae4269e0796343cc51fde7c0642683a0211fde4d6808ce1a0a6b95b39f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42067.exe

Filesize
468KB

MD5
aec9f6d2a1bdcf5e8976920192b0e414

SHA1
c115a47f62ac46b1fd44d5b20ccce9cfbf9f4897

SHA256
a4268fe9f3b62c7b3746cb531acdb865044ba48172f746809535a100c6695666

SHA512
a317b401d3fc54e588c5538fba199953cb2571a23a42f744d9dffc08361ac35f8fd8fa00def751db18128229d1b371ee6eb02a530b07824438e3f94a45b4be56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42971.exe

Filesize
468KB

MD5
471d43f62bd1e23bc641f2aa9a8b18f6

SHA1
064eb2618c700e358352b61b0306950a50eeb9d0

SHA256
e303d6b66006c372a3b0fe1b00fa7b48f8d6ae7e5e0556fc5173f50dc2a4e41d

SHA512
ba24f3cf599dd61513297ac74bf2b9acecf3d18e6f4b2142e274bfaa7a487120514a5857a6876dfe406a0a194f7e9e453845ca2d12bdf59694350e5e8002db9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47346.exe

Filesize
468KB

MD5
dd327d39ae88b74939ec9d78eada0f03

SHA1
3929bc6e94c40d38b0d8f367425c70c580e1f702

SHA256
94f81a4d16c1436b4f6a7a809bcdede4590a2220b0f84f845352fc239073d6e4

SHA512
e1750dfe932a4afa825883ac6a4afef36cec49adc555537261bb02af042f274cf0294368277387fd932700c35f5d13b456e1e4bcd1014a6c93e4b37a4a8f0322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47838.exe

Filesize
468KB

MD5
879c72c9b63104885493a9fc696b84ac

SHA1
c2bcb9900daadd317d6e02d423fab2cc91e6f73d

SHA256
d9c90781b7435ef3ebde344eccf52a03b783eca128cc9b68a0986369da3e50c7

SHA512
ac711c981adf2bbeaec493282119308d208237c6bc91b1db0f986305f9c0ca4600b70b5c6c297eeff8c380927742d3923cd5c9437e72e4df4d0d9b80186d1688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe

Filesize
468KB

MD5
da3b91e9efd40c11c855b45836e9ed04

SHA1
8fb40acd81725c208bf24f2f612579f8f92b527a

SHA256
37e171e60bad8c42f6ba4735ca8a749fe10de91d8e85b3f790abf02772df14f2

SHA512
0840a28061dae094ca541c25f3dbc331fd297978d6db83566e3331337ea71f7a5a16fce2350a66dc0423ab001f1c63f14b8e4fee8487d9b11d232b99d45d16e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5088.exe

Filesize
468KB

MD5
1dd429a4db4913b8ae792afcac635a20

SHA1
cd9ebcb55ba85b34048a02c1b91d81b6d8160a69

SHA256
70f51308f6edef897726ebb7da0d642f5cbc5b9ff601ca19ee9897ac23d4488d

SHA512
96fa08cfda21e0f02d39e1a826242d7947c2e988f467034062402ad721fce1e7390feecbd6c3b6be528ae960ba9b6d703f7d8c8d58359cc4ef697f350c8f162f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50919.exe

Filesize
468KB

MD5
f5923fec7bb63156e7caa9ae409f1064

SHA1
4903fda199c90ebb3a93eda1203034ce71b4e537

SHA256
4f968788b2b79a735b1b7f2640e52db9156b4ad7676798cade7d1956ed890b8a

SHA512
ab289ea925361356b77129f09d90193e8f700fe6ee7e383d7a3ba1cd08983170a852999f668b35ac7133f75ed85e5f22372c19f22645d0730b52ff39420f9ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60484.exe

Filesize
468KB

MD5
d3efe73f9295a0a79bbe604c13beb673

SHA1
8e9e60e1afd595a8e8402091901ff25a9c8e0414

SHA256
e589b71c65581a023bdec70e901d55520505ca68ac23208bc0622009ec9c9e9a

SHA512
7324f63b5fd4e9e6d6128100266ef212921420581097e4cb892b455404d1c91aed5feb99ff7f14e3a526d7ac5e050ffce2d3f1bec2ad4be89985296cb6030a5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60660.exe

Filesize
468KB

MD5
bbf5b246a31c915dd9f83a55e592d406

SHA1
a4aea110598839b88f491599d2e446f4758c4adb

SHA256
7d2340abdc1270fb4fbabe9f672d315f15788426db41b6def44e6b8854af2f45

SHA512
acf884108e87d7b489aa57fe5cd8f0813f7286811cc67d7ff1c7a56c7cc6ef807e1a6a5a843704422b6fa8193269460977ab93bf7103b948314d9914ec6c7153

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62965.exe

Filesize
468KB

MD5
f3f46e08748e1b4c3adfa7aa2921d1ec

SHA1
0f08be77a022d98cd308aeb7b8453b84e837c3bb

SHA256
ae1e0655abc2718ac9683ecef52f0406889417f701183227900b9ba4bc14a069

SHA512
6612ff5f4fb4b3339a2786c96055d917101063292141226041377fddfc1a47c4ca7c7685fa85a7793049f357a5b26683fd71b2751d84651db0e427f7253034d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe

Filesize
468KB

MD5
0c6c0b22f99e7ae8e5115927f2fbeb45

SHA1
48c225cba6b9073eed3d57eee1930515f74f23b7

SHA256
592e6f74a241635577c45ac15a785248d5854ec85c8c642359b8acaea84492da

SHA512
8153e4cef6015fca72ba49a087e65bef103e425f763cc6d6f3410a4cf55f5fbdfadd9b3db6c270ad632db718b23c241bafafb787ab80c11563c7522ddeb3470b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe

Filesize
468KB

MD5
23b636fda5a7a28d1c16400d9d88cdaa

SHA1
c82b031e3862161497598abeff0de11a87390fc8

SHA256
7b4a5816d88c4096b9170d9af8544f6e2db90b378a916e9c0cc63d64bfbd9c3e

SHA512
2b64a3015e78c80f2bd8abc7e310950218289cfdcb2b2ba78c65dbf007cd09b08bf70176cd710179763ff3538bd58b816fe858d6e0b7940828a4fc963feaad5d

Download Submit
memory/8-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/592-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-2313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/732-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/788-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/888-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1020-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-122-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2488-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3612-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4436-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12404-2469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12680-2524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14208-2578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14340-2523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14748-2522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14760-2539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14780-2329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15216-2375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads