232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3

Analysis

max time kernel
118s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe
Size

468KB
MD5

0bfca494610222e7d54d6587c2d91860
SHA1

01383876437d45a19366864f084d25fdd0e02a5a
SHA256

232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3
SHA512

e85f0d4b887a288229c71a5d8017fbb85844b9f86778b9fb1c16a83eac4c35126b5b9908921296c72676642fd7ab56b648c4f965f5fd781eb571edc9e4550a99
SSDEEP

3072:b8ACog5dPp8UI7YbPzijkx8/9CbCt4pCndHeiVoTSUJlAlI2RNl+:b81om6UIIPejkxQEBDSUbYI2R

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1288	Unicorn-24606.exe
4744	Unicorn-63282.exe
5648	Unicorn-26888.exe
6092	Unicorn-8373.exe
3884	Unicorn-62213.exe
6004	Unicorn-58534.exe
6064	Unicorn-60572.exe
2324	Unicorn-3085.exe
4540	Unicorn-24252.exe
456	Unicorn-19422.exe
844	Unicorn-13291.exe
3380	Unicorn-23241.exe
1580	Unicorn-19422.exe
3648	Unicorn-44865.exe
2308	Unicorn-1860.exe
2120	Unicorn-51238.exe
2664	Unicorn-34902.exe
3484	Unicorn-15036.exe
5608	Unicorn-43070.exe
5676	Unicorn-43070.exe
2832	Unicorn-18300.exe
5544	Unicorn-9635.exe
3056	Unicorn-64237.exe
4920	Unicorn-12435.exe
3644	Unicorn-18566.exe
1800	Unicorn-24186.exe
4332	Unicorn-26223.exe
3664	Unicorn-22907.exe
5632	Unicorn-28773.exe
5604	Unicorn-9172.exe
5756	Unicorn-13661.exe
4508	Unicorn-4724.exe
1196	Unicorn-46334.exe
5088	Unicorn-29806.exe
2236	Unicorn-23675.exe
5384	Unicorn-35596.exe
5512	Unicorn-63630.exe
1116	Unicorn-39126.exe
1356	Unicorn-25805.exe
1544	Unicorn-50808.exe
1540	Unicorn-59473.exe
2980	Unicorn-39872.exe
4176	Unicorn-59738.exe
4236	Unicorn-2369.exe
2148	Unicorn-19452.exe
5472	Unicorn-19452.exe
2732	Unicorn-45440.exe
3064	Unicorn-60506.exe
5580	Unicorn-60506.exe
4756	Unicorn-20220.exe
3368	Unicorn-43905.exe
4208	Unicorn-25211.exe
4024	Unicorn-36002.exe
3984	Unicorn-7413.exe
4700	Unicorn-51960.exe
6120	Unicorn-34339.exe
4100	Unicorn-40470.exe
5408	Unicorn-52722.exe
4380	Unicorn-27761.exe
5420	Unicorn-8160.exe
4684	Unicorn-37078.exe
1648	Unicorn-29142.exe
6060	Unicorn-61492.exe
6100	Unicorn-17444.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
15836	6636	WerFault.exe	451
9740	16572	WerFault.exe	903

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46853.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2892	dwm.exe
Token: SeChangeNotifyPrivilege	2892	dwm.exe
Token: 33	2892	dwm.exe
Token: SeIncBasePriorityPrivilege	2892	dwm.exe
Token: SeCreateGlobalPrivilege	9308	dwm.exe
Token: SeChangeNotifyPrivilege	9308	dwm.exe
Token: 33	9308	dwm.exe
Token: SeIncBasePriorityPrivilege	9308	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe
1288	Unicorn-24606.exe
4744	Unicorn-63282.exe
5648	Unicorn-26888.exe
6092	Unicorn-8373.exe
3884	Unicorn-62213.exe
6064	Unicorn-60572.exe
6004	Unicorn-58534.exe
2324	Unicorn-3085.exe
4540	Unicorn-24252.exe
456	Unicorn-19422.exe
844	Unicorn-13291.exe
1580	Unicorn-19422.exe
3648	Unicorn-44865.exe
3380	Unicorn-23241.exe
2308	Unicorn-1860.exe
2664	Unicorn-34902.exe
3484	Unicorn-15036.exe
2120	Unicorn-51238.exe
5608	Unicorn-43070.exe
5544	Unicorn-9635.exe
2832	Unicorn-18300.exe
5676	Unicorn-43070.exe
3056	Unicorn-64237.exe
4920	Unicorn-12435.exe
3644	Unicorn-18566.exe
1800	Unicorn-24186.exe
4332	Unicorn-26223.exe
5604	Unicorn-9172.exe
5632	Unicorn-28773.exe
3664	Unicorn-22907.exe
5756	Unicorn-13661.exe
4508	Unicorn-4724.exe
1196	Unicorn-46334.exe
5088	Unicorn-29806.exe
2236	Unicorn-23675.exe
1356	Unicorn-25805.exe
1116	Unicorn-39126.exe
5512	Unicorn-63630.exe
5384	Unicorn-35596.exe
1544	Unicorn-50808.exe
1540	Unicorn-59473.exe
4176	Unicorn-59738.exe
5472	Unicorn-19452.exe
2732	Unicorn-45440.exe
2148	Unicorn-19452.exe
2980	Unicorn-39872.exe
4236	Unicorn-2369.exe
5580	Unicorn-60506.exe
3368	Unicorn-43905.exe
3064	Unicorn-60506.exe
4756	Unicorn-20220.exe
4208	Unicorn-25211.exe
4024	Unicorn-36002.exe
3984	Unicorn-7413.exe
4700	Unicorn-51960.exe
6120	Unicorn-34339.exe
5408	Unicorn-52722.exe
4684	Unicorn-37078.exe
4380	Unicorn-27761.exe
1648	Unicorn-29142.exe
4100	Unicorn-40470.exe
5420	Unicorn-8160.exe
6060	Unicorn-61492.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1288	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	85
PID 4548 wrote to memory of 1288	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	85
PID 4548 wrote to memory of 1288	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	85
PID 1288 wrote to memory of 4744	1288	Unicorn-24606.exe	88
PID 1288 wrote to memory of 4744	1288	Unicorn-24606.exe	88
PID 1288 wrote to memory of 4744	1288	Unicorn-24606.exe	88
PID 4548 wrote to memory of 5648	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	89
PID 4548 wrote to memory of 5648	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	89
PID 4548 wrote to memory of 5648	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	89
PID 4744 wrote to memory of 6092	4744	Unicorn-63282.exe	92
PID 4744 wrote to memory of 6092	4744	Unicorn-63282.exe	92
PID 4744 wrote to memory of 6092	4744	Unicorn-63282.exe	92
PID 1288 wrote to memory of 3884	1288	Unicorn-24606.exe	93
PID 1288 wrote to memory of 3884	1288	Unicorn-24606.exe	93
PID 1288 wrote to memory of 3884	1288	Unicorn-24606.exe	93
PID 5648 wrote to memory of 6004	5648	Unicorn-26888.exe	94
PID 5648 wrote to memory of 6004	5648	Unicorn-26888.exe	94
PID 5648 wrote to memory of 6004	5648	Unicorn-26888.exe	94
PID 4548 wrote to memory of 6064	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	95
PID 4548 wrote to memory of 6064	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	95
PID 4548 wrote to memory of 6064	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	95
PID 6092 wrote to memory of 2324	6092	Unicorn-8373.exe	99
PID 6092 wrote to memory of 2324	6092	Unicorn-8373.exe	99
PID 6092 wrote to memory of 2324	6092	Unicorn-8373.exe	99
PID 4744 wrote to memory of 4540	4744	Unicorn-63282.exe	100
PID 4744 wrote to memory of 4540	4744	Unicorn-63282.exe	100
PID 4744 wrote to memory of 4540	4744	Unicorn-63282.exe	100
PID 6004 wrote to memory of 456	6004	Unicorn-58534.exe	101
PID 3884 wrote to memory of 1580	3884	Unicorn-62213.exe	103
PID 3884 wrote to memory of 1580	3884	Unicorn-62213.exe	103
PID 3884 wrote to memory of 1580	3884	Unicorn-62213.exe	103
PID 6004 wrote to memory of 456	6004	Unicorn-58534.exe	101
PID 6004 wrote to memory of 456	6004	Unicorn-58534.exe	101
PID 1288 wrote to memory of 844	1288	Unicorn-24606.exe	102
PID 1288 wrote to memory of 844	1288	Unicorn-24606.exe	102
PID 1288 wrote to memory of 844	1288	Unicorn-24606.exe	102
PID 4548 wrote to memory of 3380	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	104
PID 4548 wrote to memory of 3380	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	104
PID 4548 wrote to memory of 3380	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	104
PID 5648 wrote to memory of 3648	5648	Unicorn-26888.exe	105
PID 5648 wrote to memory of 3648	5648	Unicorn-26888.exe	105
PID 5648 wrote to memory of 3648	5648	Unicorn-26888.exe	105
PID 6064 wrote to memory of 2308	6064	Unicorn-60572.exe	106
PID 6064 wrote to memory of 2308	6064	Unicorn-60572.exe	106
PID 6064 wrote to memory of 2308	6064	Unicorn-60572.exe	106
PID 2324 wrote to memory of 2120	2324	Unicorn-3085.exe	107
PID 2324 wrote to memory of 2120	2324	Unicorn-3085.exe	107
PID 2324 wrote to memory of 2120	2324	Unicorn-3085.exe	107
PID 1580 wrote to memory of 2664	1580	Unicorn-19422.exe	108
PID 1580 wrote to memory of 2664	1580	Unicorn-19422.exe	108
PID 1580 wrote to memory of 2664	1580	Unicorn-19422.exe	108
PID 6092 wrote to memory of 3484	6092	Unicorn-8373.exe	109
PID 6092 wrote to memory of 3484	6092	Unicorn-8373.exe	109
PID 6092 wrote to memory of 3484	6092	Unicorn-8373.exe	109
PID 4540 wrote to memory of 5608	4540	Unicorn-24252.exe	110
PID 4540 wrote to memory of 5608	4540	Unicorn-24252.exe	110
PID 4540 wrote to memory of 5608	4540	Unicorn-24252.exe	110
PID 844 wrote to memory of 5676	844	Unicorn-13291.exe	111
PID 844 wrote to memory of 5676	844	Unicorn-13291.exe	111
PID 844 wrote to memory of 5676	844	Unicorn-13291.exe	111
PID 1288 wrote to memory of 2832	1288	Unicorn-24606.exe	112
PID 1288 wrote to memory of 2832	1288	Unicorn-24606.exe	112
PID 1288 wrote to memory of 2832	1288	Unicorn-24606.exe	112
PID 4548 wrote to memory of 5544	4548	232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe	113

C:\Users\Admin\AppData\Local\Temp\232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe
"C:\Users\Admin\AppData\Local\Temp\232e6660ae8ba422f8926e892bc1c4bcdbc047857e68c282c993c376c73360a3N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51098.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54938.exe
        9⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37658.exe
        10⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12748.exe
        10⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        10⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        9⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
        9⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
        9⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        9⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62354.exe
        9⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
        9⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49704.exe
        9⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        9⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        8⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        7⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11729.exe
        9⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        9⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        8⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6636 -s 656
        9⤵
        Program crash
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        8⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        8⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        8⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18891.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        7⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35596.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45234.exe
        8⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46298.exe
        9⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
        10⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        10⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39876.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        9⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        9⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33951.exe
        9⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        9⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        8⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62893.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22946.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        8⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6831.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        7⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42074.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        7⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20463.exe
        6⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55450.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        8⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34399.exe
        6⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38344.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46334.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        7⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45805.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49644.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        8⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39358.exe
        8⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48201.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57380.exe
        8⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47917.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        6⤵
        Executes dropped EXE
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56334.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5841.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        9⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11080.exe
        9⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        8⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
        8⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        7⤵
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        6⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63506.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        7⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
        6⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7325.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34046.exe
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        9⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        9⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34849.exe
        9⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17152.exe
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2525.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1953.exe
        8⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        7⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        7⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51948.exe
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53685.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50449.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37938.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        7⤵
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41548.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58002.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22800.exe
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16205.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        9⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        9⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32209.exe
        8⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        9⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        9⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        8⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        7⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21114.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        9⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
        9⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        8⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43708.exe
        8⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11928.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30365.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        7⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9083.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35222.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8503.exe
        7⤵
        
        PID:18200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10916.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
        5⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18088.exe
        8⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        7⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56846.exe
        7⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16384.exe
        7⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44852.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45737.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53397.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64280.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        5⤵
        
        PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        6⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6609.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7128.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52636.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        7⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16012.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        6⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28684.exe
        5⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50574.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        7⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48405.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8647.exe
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        5⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8096.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29573.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        5⤵
        
        PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35606.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        6⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        5⤵
        
        PID:16796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29066.exe
      4⤵
      PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45687.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
      4⤵
      PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
      4⤵
      PID:16416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        7⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14092.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26989.exe
        9⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10572.exe
        9⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
        9⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        8⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        8⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59156.exe
        7⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59077.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        7⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        6⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17238.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45421.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7408.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26527.exe
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50089.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39872.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        6⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51730.exe
        8⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        7⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        6⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        6⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32331.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7091.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        7⤵
        
        PID:18196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24550.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49392.exe
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33300.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2369.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13189.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10709.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15319.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        7⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64933.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2151.exe
        7⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26904.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36676.exe
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        7⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5051.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        6⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57673.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28707.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59620.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49147.exe
        5⤵
        
        PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        7⤵
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1212.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57472.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        5⤵
        
        PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
      4⤵
      PID:992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58958.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16539.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50153.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49069.exe
        6⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40958.exe
        7⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11845.exe
        8⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
        9⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        9⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12455.exe
        9⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45052.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        7⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56172.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30059.exe
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        6⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55353.exe
        5⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48876.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51024.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23679.exe
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36101.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30619.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12364.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        6⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28983.exe
        6⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1727.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        5⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56836.exe
      4⤵
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        5⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        6⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        6⤵
        
        PID:720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        6⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3672.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7496.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18063.exe
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1425.exe
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16091.exe
      4⤵
      PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        6⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47834.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59778.exe
        8⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        8⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        7⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59898.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57505.exe
        7⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        6⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43048.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-90.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        5⤵
        
        PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5855.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54850.exe
        5⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12698.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28953.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3412.exe
      4⤵
      PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        5⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11164.exe
        5⤵
        
        PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11637.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      4⤵
      PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17274.exe
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19469.exe
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-989.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13767.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51553.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        5⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33294.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48876.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12961.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48929.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21579.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      4⤵
      PID:9916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12996.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
      4⤵
      PID:6252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
      4⤵
      PID:13352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
    3⤵
    PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-69.exe
      4⤵
      PID:14648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37602.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
    3⤵
    PID:13168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32724.exe
    3⤵
    PID:15864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25211.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42546.exe
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45525.exe
        8⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6959.exe
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4757.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33752.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        7⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        7⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47072.exe
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35586.exe
        6⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44471.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19962.exe
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22285.exe
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        8⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50333.exe
        7⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        7⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13324.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29607.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        5⤵
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62162.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49505.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21195.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46677.exe
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
        5⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14868.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        5⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53278.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        7⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58109.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        5⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        6⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57585.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48936.exe
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
      4⤵
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16339.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        6⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3951.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51625.exe
        5⤵
        
        PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7724.exe
      4⤵
      PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9173.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
      4⤵
      PID:10780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
      4⤵
      PID:16572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16572 -s 436
        5⤵
        Program crash
        
        PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1440.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50102.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34476.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30435.exe
        7⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        7⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1543.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57273.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1057.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45289.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17652.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57348.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5331.exe
        5⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        6⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26153.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        5⤵
        
        PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34339.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        5⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        6⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        8⤵
        
        PID:18012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3887.exe
        7⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        7⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44844.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9847.exe
        6⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30803.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13332.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        5⤵
        
        PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56069.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24685.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        6⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        6⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8340.exe
        5⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        5⤵
        
        PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2531.exe
      4⤵
      PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1005.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        5⤵
        
        PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-952.exe
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
      4⤵
      PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6692.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
      4⤵
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        6⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12224.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        5⤵
        
        PID:16680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45980.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20660.exe
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7411.exe
        6⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60325.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65340.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        5⤵
        
        PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14528.exe
      4⤵
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
      4⤵
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45172.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26403.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
      4⤵
      PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60251.exe
      4⤵
      PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
      4⤵
      PID:14548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
    3⤵
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42598.exe
      4⤵
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52754.exe
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43635.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48352.exe
      4⤵
      PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
      4⤵
      PID:17132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
    3⤵
    PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63598.exe
      4⤵
      PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27500.exe
      4⤵
      PID:7492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18593.exe
    3⤵
    PID:9472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28835.exe
    3⤵
    PID:13420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
    3⤵
    PID:16580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1860.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1860.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24186.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46630.exe
        6⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53241.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
        7⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59666.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58377.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        7⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20287.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        7⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2927.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39732.exe
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58597.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37091.exe
        6⤵
        
        PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        5⤵
        
        PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
      4⤵
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6225.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33325.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42984.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24860.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        5⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
        5⤵
        
        PID:1264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1851.exe
      4⤵
      PID:2680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        5⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16366.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18563.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55597.exe
        5⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14204.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        5⤵
        
        PID:17876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31443.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56957.exe
        5⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44906.exe
        6⤵
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        5⤵
        
        PID:17984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42856.exe
      4⤵
      PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59706.exe
        5⤵
        
        PID:960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49836.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49896.exe
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62318.exe
      4⤵
      PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-171.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        
        PID:17812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        5⤵
        
        PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36426.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20863.exe
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11107.exe
      4⤵
      PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
      4⤵
      PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
    3⤵
    PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39853.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
        5⤵
        
        PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28507.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      4⤵
      PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26452.exe
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34930.exe
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
    3⤵
    PID:12456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
    3⤵
    PID:16528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52634.exe
        5⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25686.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49749.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13147.exe
        6⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        5⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58501.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-136.exe
        5⤵
        
        PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50204.exe
      4⤵
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        5⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22830.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48009.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        6⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18471.exe
        5⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55569.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
      4⤵
      PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
      4⤵
      PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
      4⤵
      PID:16492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19452.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18426.exe
      4⤵
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64414.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48213.exe
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        5⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46853.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50468.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      4⤵
      PID:16704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
    3⤵
    PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49490.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61049.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11072.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3811.exe
      4⤵
      PID:12828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
      4⤵
      PID:4432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
      4⤵
      PID:17008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37139.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
    3⤵
    PID:14248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59474.exe
    3⤵
    PID:2620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10620.exe
      4⤵
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11596.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27801.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60588.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31108.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54548.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31500.exe
      4⤵
      PID:17968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
      4⤵
      PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11477.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14772.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48036.exe
        5⤵
        
        PID:17932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19144.exe
      4⤵
      PID:1124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37952.exe
    3⤵
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46573.exe
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43925.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26148.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61580.exe
      4⤵
      PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61589.exe
      4⤵
      PID:9796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
    3⤵
    PID:7904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47996.exe
    3⤵
    PID:11024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63425.exe
    3⤵
    PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55390.exe
    3⤵
    PID:17000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15686.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15763.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52296.exe
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32025.exe
      4⤵
      PID:14772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
      4⤵
      PID:16956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
    3⤵
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2141.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41580.exe
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      4⤵
      PID:12428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30074.exe
    3⤵
    PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35010.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9816.exe
    3⤵
    PID:10664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22015.exe
    3⤵
    PID:14372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38324.exe
    3⤵
    PID:16860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51218.exe
    3⤵
    PID:10040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38772.exe
    3⤵
    PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13348.exe
      4⤵
      PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
      4⤵
      PID:17656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62420.exe
    3⤵
    PID:8988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
    3⤵
    PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25975.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
  2⤵
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
    3⤵
    PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
      4⤵
      PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15387.exe
      4⤵
      PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23464.exe
    3⤵
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57680.exe
    3⤵
    PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
    3⤵
    PID:16540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55676.exe
  2⤵
  PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54942.exe
    3⤵
    PID:16288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30089.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52325.exe
  2⤵
  PID:16456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6636 -ip 6636
1⤵
PID:15716

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1264 -ip 1264
1⤵
PID:18168

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:9308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10003.exe

Filesize
468KB

MD5
4b490c6beeccf640f444f3ec27d9cc5f

SHA1
d7fbbcfd3fa0fc97333bfd52695a8c9228f87f14

SHA256
7e9b8ef3aab3faf36e8bcf9a518136430b4c5f49dfd153aac17608dd999426f7

SHA512
d4573a876e2700ddf374300217664bb7d978061df65e23f64dc9a6caec7eca6c5945420e614d9e923b451544b47ee9669609b0985b04660f18214faf38a71d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11080.exe

Filesize
468KB

MD5
db40a46eb0df9cee6e41e18cb8ba260b

SHA1
d8807f580b54942e5982948258255fd741572b02

SHA256
b1746574d429fd52629c8e23cd239dd47a68f64ab72e1586de5523ac78588ebf

SHA512
c44cf6aea187060bb35bcb975f21785a8b2a9c7f38fddf5fb57c0f4d07f7db0a1469838b4ddf674b70adb9ca5c9a7864faeb67edb93c01db64fb4fd5eeea2d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12435.exe

Filesize
468KB

MD5
60bdd7708d198851e1915514adecc542

SHA1
100d0b237cf1cb7d77f6dde8950b7e8e98a33e9f

SHA256
eda214c531333f1a205a03faba0d80faca9ad5c1a11ad0d3728ac13b2ebce347

SHA512
4ba3023fbaee94aaaf60e50bfcb81d63de68d7f635a24c44b4bc6725a2fd4ebc686efea186bc26d6ebd991898cbbb28e2cef3f2fee3e4949523fcbf5e3913cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe

Filesize
468KB

MD5
ebf0d8b5d7d655bcd8a6c6646b120c74

SHA1
4108345d340b1f416f028c5b8e508b4d03dde89d

SHA256
ec8731a71021c6b7784d2ca8c5115753cc42111ccf90ea482e746884d480ba83

SHA512
9e5d2cd755537c4a5c0f5dc17cb2bdce8edc7b2291840bc24cc76a8eb37e6fdc2109bf0efa66600b0818d482a0a9cccee92fb5bb9cce380999f73917a2a129e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13661.exe

Filesize
468KB

MD5
5922061da19368898a619439544609ad

SHA1
d2e54965515d0f7d0818f097d0ba179bfd1147cb

SHA256
e0d0377fae060ce9c5bfd0de7e8838defc34366dd5a380d3d8c61d6458846c9f

SHA512
6a26953d7c5fb3f7417731c2b504f0774320daf0512f92747a748a96f89e23849b0a9216e8f6216e0c7a96adbb150bda3f7d2f64f688362c8c964a803373297e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15036.exe

Filesize
468KB

MD5
13b0630afa7bec248a078398581da3c3

SHA1
9aff4f305442744bb3be879d3d05c06979f1083e

SHA256
9530075a898dd4ece991e5c56dffdfcdc326d10625bb402d691a094f70e05792

SHA512
83b96b51485ee0d65f8ff93686161c57217c306eaec6aa84768e50bbe4d52a0e364febcfdcfcb8837f6d09a7ce47578c58b9ee8afcf5cbe950708dbccfb785ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18300.exe

Filesize
468KB

MD5
c3bc12913acfe6f70d81b411230a8c85

SHA1
90a685c4609093c37ece60c1ce842624491cf2b8

SHA256
b73469a4152934b5535b2f033dde59e4c9df14cea24dada803943a57a9b11491

SHA512
645bf1c1002d7ad0b80d080b540f1f9620a55a1da35d16272f91beeb1763cd6911bc172981a778077f41386c3dfba90557726deb79828bfdf12791aaa43743e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe

Filesize
468KB

MD5
d0ca6d8e66d4c7e8660655f993ee4b09

SHA1
d4edb04c36da7791749bdff69cad33f81faa616f

SHA256
a9c715cc812d541fea7fc6c00d22ec0cbac6f4371a619addb4d98c5b96f94440

SHA512
8321ff2137c518b71335ee278b49d4d221f443fb7bd24266a156005126d0e738d4d83946eb4d671f08f26c2af592a18f9a1c00f2d097cb0a9486592a440193ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1860.exe

Filesize
468KB

MD5
a49a0503bf0de1df9ffdb255a99fa527

SHA1
ec4b8d7f0ee320eea552728eb50ad0ef0584bb2b

SHA256
5aa0dfd1d33aaa8206f9b2b7772c75710dcc24242879289a9ff153355a9c3185

SHA512
19d2221c3188210dbacbe40a5c6f3fac77afbb47351162fb5067e4e8fcf54ff511ce6784dfb97a557139f025346fc38f92d06416b0fb6cdd89615da98945b0e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19422.exe

Filesize
468KB

MD5
1393d305fab462f8ea7b86d0718d8ecf

SHA1
97377f671ca6ab4aa1d73e3418ac690c67a2cbf4

SHA256
d41673222c73fb3e7b4c75d442e7510a04abe90186b9654e60a0be107199e6b2

SHA512
8d7f2301f1b3f9f40559ca162779ee63d2729554fa4d1d1f6c59f105f08556424e7b906cdac8c4efddd8e5f7443a7ebb753555b00782987a08eb597c4009e60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21410.exe

Filesize
468KB

MD5
beb834e7b7fb87da3bcde1c621dfa335

SHA1
1f729450e952c1d37788601bd841dbb781b3086f

SHA256
ab5a32a3d9e7f99efdbf7d28fcc8cc3e1114da72d2f071984f5aac4e4ada814d

SHA512
1cae64376397059be6be95b5266c2a1973ba00ad44f83ffef8488d86f9f592f343cae369d59d86e7bab184e569424734f95f65d86ef7be8e73def1ee1d97ca1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22907.exe

Filesize
468KB

MD5
078f848f9b4f84ca91478be2a3f7d1ae

SHA1
fe108a6f8db2f5fe8278dde87ec5a96d165f9a28

SHA256
1fccea4547a931fd8958c6ae1487ed15a523805df74537839191671f7098aba2

SHA512
bf7bd29ba65a13c7135fafedae6c0abc43d3c6645bd0ed0e578ab2cabe07ae3f0aa8fac21cb1de21224c927eb071127e65e0fe84c3eaf1e430e9c60520731526

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe

Filesize
468KB

MD5
d86771fcca7b4969758b678ad4ebb752

SHA1
ca2ac6ec0ce1c51c451b00130193003106dc74b5

SHA256
4cf81d3e8867eb89710b1bd4ce3448e454421f51a16557c47a74daafcb7502b0

SHA512
4858522b0b7ebdae89a2ae7194bf8719db57eb646077c4ba6bec927a93f91ae5a3596bf8cde39f28a85e9a2592e061e317fc6c9f47f59596f4bbb0e112173680

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24186.exe

Filesize
468KB

MD5
89e5bbe4ccf2b80feb0e10600aaf3706

SHA1
cf5f234e1823a38a7e2cc3744deb9edba5c2d170

SHA256
87eaeea2dbea0dd4bfac3f6264bec2c9055a015e95d05f2187f6aa159ea0b940

SHA512
17d9196c078f01c36d5d7618511db4edaaf6f9e759a808d6b965be7cea2db9fc68606db9a5163c2e4e37c97adb152d3860166e2a272e0071f8901afab59f841a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe

Filesize
468KB

MD5
5bbf2449adb11f6da1651542fb17af39

SHA1
c3b19abc7e4f65327026cdf848769dd6dc9386db

SHA256
a06e0148717c23b48995f3cca551fc99bc1aa097d2c29fe109a70245f47abe50

SHA512
ca5b20cd06be0e168db9c26cf4a4cf72fcc791fa14969b3f8d4002e68f071018f25cd93be3b0929ca7b197caaf0cbd45e673c7d0d8b7cb788ef7a9ffbe3f21ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24606.exe

Filesize
468KB

MD5
50206e0eaa01ed4693be86b98a17d5db

SHA1
dfd621d182dd869d7e6d7481a55d9782cd1e2751

SHA256
efd20ed603951839c1d5c3d3aad2b96224ac97b2ab2ee60fbc3328471d265a64

SHA512
1dd0b6b55df51ed5030514d82c377b25e6d61ab9404d731c3ff5d501cc10b6c3df9b4f9ff3b4e6ac525941339d8428a52e4119eb0a89e5119e5b53d7a787f8f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26223.exe

Filesize
468KB

MD5
46e52971496232537643fd1a853143f8

SHA1
deff104be868f2f4e4fd2e669588b24d8a159a5f

SHA256
dbfc57ba22761b49f201fe3c2c175a602d7975badacde31cd8729c485dfc3fba

SHA512
5e5057be961857ccca33b350228d3fc4dc5b0d79a825970c00d76cf33db12901307e28cf3e249f7b1c8f5fc7409d3cc6540fad425b64547355cfd2edeadb3450

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26888.exe

Filesize
468KB

MD5
f125956426ec8f7a7030a8118af49f03

SHA1
12884f78ff319043f2ceaa854bb1ea9c82919305

SHA256
2b192d9b5bc387fe2759624f0eb52febdb9efac39cdc71dce0646c4e0d872935

SHA512
e7db6d282a22aa1d73b41982d1b2a36b3df425df53a944f9ebe370f3b260cde870b562673734fa6437b6dbc2b00a04d77a178205edc09b150db7d5b2a2eb5027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28773.exe

Filesize
468KB

MD5
e9d1cf47af29139cd12168c910e701a7

SHA1
a6e7eacec9c70c05e3ca49eb7c05259b32456888

SHA256
954387637658525f222acb14af8c40492add2879e190f817b8f2474ae583b5b6

SHA512
69f206cdcf0203f3c56f314f3cfb762a9f6c8d9932e8e75cc9a78f46399abca29c47a06320b612cce4a1b35e707e387b2ff383fd974c4de7382de2bb682010d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe

Filesize
468KB

MD5
e21c438a6ee228d2aec19096d9bd5eb4

SHA1
371703c4e92f6c8155c2d62d339f97442f3d9b39

SHA256
1e708b84961c2f36f0287313501c8aea0f2e9e3b15b0421c9c0faa79c595ef6a

SHA512
c954e9f6761a12457bb2aa5fdabcaf23a1fd473515598f5a230617fc9d9dd13cb1b368690b6da24e74093c41dea23e89b5d62c9efa692ae870326f5a60ffc3f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33538.exe

Filesize
468KB

MD5
3ecb320a94205dc14501e050db4b6992

SHA1
1ce687ecdc5b6d751514826900beb30f3e173654

SHA256
3e00ced4dcf3f0d4055da93dd8f8c6dcc92879e5718fb30de1867bf0e6aa98de

SHA512
6811b6a090685afbab343111536dee925e6e97554a852833d237efa8a0639c86b35b0b519401b3b2188996d95357b47ae107339aae50aaadc55c9bd593aa92d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe

Filesize
468KB

MD5
eb389399efe3c0b7637f8ece99a8f9e5

SHA1
bc76f86861a85c243cfdb856b1f2f7eeec2aed8a

SHA256
23f8337b0497ed54cfdbd5e35b11fdec73ef4ce3a78c0d8767f4b00bec62468f

SHA512
935a83dcb8f840e8dd80c1db2482084aad230166b1ae9c9a57ee896cbcf996f9ee4b5bc5daf004dc0052b6ae64fb12359c13302d263d19f11fa4b86543bc1529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43070.exe

Filesize
468KB

MD5
4793177f21cadd5e42dc4c8b3c48fce1

SHA1
b5724bcb69f6604169c1da58a77a805882a91739

SHA256
3953f7643dba45e0d5feb51227041a7b7fbd8f0b72070efbee3bd9a17c6b1411

SHA512
1b2023dc67ab778038abbae54781069fe231148da5448386f5e7ea2a17a858b00c24daefdc4c2f785ed0a4d4a70a62338d98577d4d24c46a08c8eb0772bd90ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44865.exe

Filesize
468KB

MD5
2430d32f301291938b3eb9d78c59993e

SHA1
33da4726ad96f8a577e79aa76430e35b0b286e8b

SHA256
9c096ba64b4b6249388d2396967509191c240f20c4012149c3ff2d220fe23248

SHA512
709c6dbcca2eac6129261d8a9e8fd25ce8d875e2ded0ffdad9fad075059ef47d9decb9e1be02547e4aef58e8c93b5f6c566ca5bd3d7713e1ba19f6608b525ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe

Filesize
468KB

MD5
c954bf1e34573f09cc19973b8dde0d45

SHA1
603f41f39cfa48af9e67695acba064988f571c73

SHA256
701935b17486d0adb1781b41cb25fa1ce4e453db362441efa2547616b99cfa76

SHA512
0f8385980ec7cb601a64b4b52eb6301ebf6887bf6f69fe3eb6de8565341148aaf75ee9d2e1f8bf877c12543443db9aabfd914270c1744f1eb2770d24c1db64a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe

Filesize
468KB

MD5
d1c8621058a1f5d00e16e141e5d141af

SHA1
33f3ad1eeb76e5f12a14c27eccf22a97db4e0a81

SHA256
94885b11e4cf9059c834a7d8ed27fd761f3e27aad299fbcf5fc26e9fd3fab3ad

SHA512
a650786e3432ac71e496c42f2333ec4bca313cf45e6dc7f5730fe70fd343ee78da91ebc1571c2ec36deac743f0b8c3a91f0bc69fabf0481ae06f84b3e798a9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe

Filesize
468KB

MD5
9d12bfd34c8eebff055517dbb3a39e50

SHA1
6dfb3ab77bb50103ad9b58ab05f17bd55953db6d

SHA256
06bc7bc8a04e434c1e87a4435c048704088359c49964b917c117fcbbed1178ed

SHA512
32eb147c4b7e24bf30de5bb2c71be525de056552372a110d10cd49bb755480f9e52afb5b41a27a0a3f9388fd8ad01b1fbff2874dde3f0b915afa5a1a74b4d814

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58534.exe

Filesize
468KB

MD5
d66e959066719c7119c029372c0f7d06

SHA1
54b8b018e2d2338b83273f8e1574395dfbabe017

SHA256
b0f326084f1c11f1c34351c2ff1a02eb29381dd214b23a75e9cd12e0766a87d3

SHA512
e35c2001143edc072f72dc618398d3bb0b6209dd1fa16865d8fa535c67ff44369cccb21c4ad333744f8d2ee70bd5f1cd9548db257094244f8b832a624bdf5d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe

Filesize
468KB

MD5
2d7a6f2fd28f06efff8a60a5dc552640

SHA1
debba69fb87636c30893933b1eb0f664c7f05588

SHA256
64ca259bf91c928c9c77293637eaeaad839eb62efe6135be50eecf9c96a5292a

SHA512
c38063c027024f86133856e1e0d116675830f70c3ead0f800c84116a9485e671ef389367cb6edc1d6c8f2b783b49f0ec1ac8cf140ef3f4dd98f0e1428292c996

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62213.exe

Filesize
468KB

MD5
b1c09913b2e2d967186054a0bb2dc6e9

SHA1
19dc2360ecc166d8a710b81ba2480b3da7a0948b

SHA256
733a9e195eb179f9d43afca370530ff1a3dfef6031568fd6b411b1fa382ba3eb

SHA512
dab76989a35bab8b7035c5642c3d3abf63802a54db230a14420ed498ecfcd04e54889bb9fe52c01c6234cffb20558ee1c5a02a51fe865f13601b365ee1a213ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63282.exe

Filesize
468KB

MD5
290c36b53423d225c0b8c610fcbb22c4

SHA1
08a3c59e6d38595405f5a234774dae0225aa8a8c

SHA256
9b1110d0a867a5f30a38e44ee54333bc9f04d56f802ffba06986cc12b6880de3

SHA512
7265fa1ecf70d930f2be438d23731efd25399bb26cbf601360414b77621a7ff15d3a0cad6b4b710d9b90c388467ef19018ac5b3d207c6630cb8868bc5046ad6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe

Filesize
468KB

MD5
b15a791df444de1ad577a07e0e62bcd0

SHA1
cab0161c67f558e3d42ce15f9142f55d30aa12c9

SHA256
46941ce2d2f931f9654a8cad0e41aa49e9fce3123a8171e119d25d3eb043c696

SHA512
5f38b75dd951f733d97ce05fff91c993abd54a2ca2370306d6897953a2f791f8722aff77b553a9e227f53f6665b230942d02ab0525346670aeb50b4aca36c9fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8373.exe

Filesize
468KB

MD5
8ea22e635e41813f7eb4e50913b92381

SHA1
e6be0ef4b289ccfa43518e82405aee8a7a8e55d3

SHA256
ccfd9ed2b3b94db1d4b3458d1921911db69aa98b245467393d3164d6e4511584

SHA512
1f90baab0ae39357ffe252e85622112957a804ed320423843ba2d911cc119fad0a6d101de159a0c2cfff9ef4d1f57946fc7af4b8d8bfdd179e2064865860f182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe

Filesize
468KB

MD5
f8286efe96b07305e1f19781f4b95f1d

SHA1
8cef1b4fc15b728e42b9b5488be2aa9fd0d967fb

SHA256
0fd6f95e0eb013b2c85a843f6cb087c33c1a962e4d7ab2f289aed1fcffc94c6c

SHA512
f249c722c0cabc3788559caa57bfd14282ce5c2a047ad0debf3b8b9c22be27d4e558de7210e7345080c69d0b120ba2e8bde10bcb208c5b0a52750ef095bcd5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9635.exe

Filesize
468KB

MD5
ef1ac5c2451e7b7161560faffb64f930

SHA1
b1d28c9687aa9ff283ce74a5a11ba7586087629e

SHA256
cbea076f524fe29eafde043b20710de3f9eef3ef547fa878fa96f1751862f9d2

SHA512
1f83b2f7fc6e2b02b6cb05e5ec96963cc13d920cb8948f981fcbb9bb9559fa9acd832168dc5457c0b2448f0e014f43ecd5d6d140683454c2000abdd4ebe98382

Download Submit
memory/376-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/756-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/992-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1344-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1540-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1648-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1800-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-108-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2832-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3552-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3908-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4456-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5604-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6004-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6060-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6064-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6092-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6100-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6120-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/9672-3391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13548-2593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14344-2590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17792-3519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/18196-3584-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads