23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e

Analysis

max time kernel
144s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe
Size

468KB
MD5

e4039c7f4c2ed19d756c2e3ae39f2213
SHA1

5facb42dabce7fde6443ddcfa0a65f9bb0cc63b7
SHA256

23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e
SHA512

6de9519ce8e31162c59eb5ab3cc84e4b8fc665d8f2b7383b5ec325dfc5f14f3dee77452ac88ce9978956cd61eb7fe3afb5c3f55a6f1d49ac97b8a52e9c1afdee
SSDEEP

3072:zbtCogIdI05UtbYVPzsjlf8/ECrCZIpVnmH9xVhCpJdLi/PuMyl4:zb4ow8UtKPojlfT08MpJZYPuM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2080	Unicorn-17098.exe
1068	Unicorn-59090.exe
3548	Unicorn-61783.exe
3372	Unicorn-9671.exe
4092	Unicorn-44482.exe
4044	Unicorn-6142.exe
2440	Unicorn-19877.exe
4860	Unicorn-20902.exe
2656	Unicorn-25540.exe
3632	Unicorn-41322.exe
1468	Unicorn-61742.exe
2548	Unicorn-61742.exe
5060	Unicorn-24.exe
3960	Unicorn-33708.exe
4052	Unicorn-47444.exe
4380	Unicorn-41104.exe
760	Unicorn-47689.exe
4504	Unicorn-455.exe
4548	Unicorn-7232.exe
4452	Unicorn-57824.exe
4928	Unicorn-2493.exe
4988	Unicorn-8623.exe
2192	Unicorn-8623.exe
4232	Unicorn-29044.exe
3944	Unicorn-48073.exe
536	Unicorn-5094.exe
2860	Unicorn-24960.exe
888	Unicorn-59505.exe
1916	Unicorn-50840.exe
4612	Unicorn-43334.exe
1784	Unicorn-13475.exe
1316	Unicorn-32504.exe
4112	Unicorn-42064.exe
2516	Unicorn-56354.exe
4996	Unicorn-10330.exe
1524	Unicorn-36610.exe
4456	Unicorn-10522.exe
652	Unicorn-16766.exe
3884	Unicorn-12681.exe
5028	Unicorn-36921.exe
1872	Unicorn-59479.exe
3132	Unicorn-59744.exe
1664	Unicorn-20658.exe
596	Unicorn-6359.exe
3684	Unicorn-12489.exe
4348	Unicorn-12489.exe
3064	Unicorn-45162.exe
3092	Unicorn-12303.exe
1488	Unicorn-21234.exe
2136	Unicorn-33486.exe
440	Unicorn-37570.exe
4244	Unicorn-17704.exe
1204	Unicorn-31439.exe
2708	Unicorn-25318.exe
1464	Unicorn-35432.exe
2828	Unicorn-29301.exe
2560	Unicorn-16958.exe
2044	Unicorn-62629.exe
1504	Unicorn-57029.exe
4984	Unicorn-16958.exe
1968	Unicorn-31902.exe
3856	Unicorn-62629.exe
2452	Unicorn-1176.exe
5152	Unicorn-12608.exe

Program crash 8 IoCs

pid	pid_target	Process	procid_target
5480	4232	WerFault.exe	120
6104	2044	WerFault.exe	154
1056	3856	WerFault.exe	157
7040	5216	WerFault.exe	166
18228	16876	WerFault.exe	770
4644	4216	Process not Found	1155
13544	6388	Process not Found	899
14268	16452	Process not Found	1181

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46857.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61887.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62081.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5240	dwm.exe
Token: SeChangeNotifyPrivilege	5240	dwm.exe
Token: 33	5240	dwm.exe
Token: SeIncBasePriorityPrivilege	5240	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe
2080	Unicorn-17098.exe
1068	Unicorn-59090.exe
3548	Unicorn-61783.exe
3372	Unicorn-9671.exe
4092	Unicorn-44482.exe
4044	Unicorn-6142.exe
2440	Unicorn-19877.exe
4860	Unicorn-20902.exe
2656	Unicorn-25540.exe
3632	Unicorn-41322.exe
1468	Unicorn-61742.exe
2548	Unicorn-61742.exe
4052	Unicorn-47444.exe
3960	Unicorn-33708.exe
5060	Unicorn-24.exe
4380	Unicorn-41104.exe
760	Unicorn-47689.exe
4504	Unicorn-455.exe
4548	Unicorn-7232.exe
888	Unicorn-59505.exe
4928	Unicorn-2493.exe
3944	Unicorn-48073.exe
4612	Unicorn-43334.exe
4988	Unicorn-8623.exe
4232	Unicorn-29044.exe
536	Unicorn-5094.exe
2860	Unicorn-24960.exe
4452	Unicorn-57824.exe
2192	Unicorn-8623.exe
1916	Unicorn-50840.exe
1784	Unicorn-13475.exe
1316	Unicorn-32504.exe
2516	Unicorn-56354.exe
4112	Unicorn-42064.exe
4996	Unicorn-10330.exe
1524	Unicorn-36610.exe
4456	Unicorn-10522.exe
652	Unicorn-16766.exe
3884	Unicorn-12681.exe
3132	Unicorn-59744.exe
1872	Unicorn-59479.exe
5028	Unicorn-36921.exe
4348	Unicorn-12489.exe
3684	Unicorn-12489.exe
596	Unicorn-6359.exe
1664	Unicorn-20658.exe
3064	Unicorn-45162.exe
440	Unicorn-37570.exe
3092	Unicorn-12303.exe
2136	Unicorn-33486.exe
2708	Unicorn-25318.exe
1488	Unicorn-21234.exe
4244	Unicorn-17704.exe
1204	Unicorn-31439.exe
1464	Unicorn-35432.exe
2828	Unicorn-29301.exe
5192	Unicorn-18995.exe
2560	Unicorn-16958.exe
5152	Unicorn-12608.exe
5228	Unicorn-23079.exe
5204	Unicorn-5260.exe
5180	Unicorn-25126.exe
3856	Unicorn-62629.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2080	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	89
PID 3088 wrote to memory of 2080	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	89
PID 3088 wrote to memory of 2080	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	89
PID 2080 wrote to memory of 1068	2080	Unicorn-17098.exe	91
PID 2080 wrote to memory of 1068	2080	Unicorn-17098.exe	91
PID 2080 wrote to memory of 1068	2080	Unicorn-17098.exe	91
PID 3088 wrote to memory of 3548	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	92
PID 3088 wrote to memory of 3548	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	92
PID 3088 wrote to memory of 3548	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	92
PID 1068 wrote to memory of 3372	1068	Unicorn-59090.exe	95
PID 1068 wrote to memory of 3372	1068	Unicorn-59090.exe	95
PID 1068 wrote to memory of 3372	1068	Unicorn-59090.exe	95
PID 3548 wrote to memory of 4092	3548	Unicorn-61783.exe	96
PID 3548 wrote to memory of 4092	3548	Unicorn-61783.exe	96
PID 3548 wrote to memory of 4092	3548	Unicorn-61783.exe	96
PID 2080 wrote to memory of 4044	2080	Unicorn-17098.exe	97
PID 2080 wrote to memory of 4044	2080	Unicorn-17098.exe	97
PID 2080 wrote to memory of 4044	2080	Unicorn-17098.exe	97
PID 3088 wrote to memory of 2440	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	98
PID 3088 wrote to memory of 2440	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	98
PID 3088 wrote to memory of 2440	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	98
PID 3372 wrote to memory of 4860	3372	Unicorn-9671.exe	101
PID 3372 wrote to memory of 4860	3372	Unicorn-9671.exe	101
PID 3372 wrote to memory of 4860	3372	Unicorn-9671.exe	101
PID 1068 wrote to memory of 2656	1068	Unicorn-59090.exe	103
PID 1068 wrote to memory of 2656	1068	Unicorn-59090.exe	103
PID 1068 wrote to memory of 2656	1068	Unicorn-59090.exe	103
PID 4092 wrote to memory of 3632	4092	Unicorn-44482.exe	104
PID 4092 wrote to memory of 3632	4092	Unicorn-44482.exe	104
PID 4092 wrote to memory of 3632	4092	Unicorn-44482.exe	104
PID 2440 wrote to memory of 1468	2440	Unicorn-19877.exe	105
PID 2440 wrote to memory of 1468	2440	Unicorn-19877.exe	105
PID 2440 wrote to memory of 1468	2440	Unicorn-19877.exe	105
PID 4044 wrote to memory of 2548	4044	Unicorn-6142.exe	106
PID 4044 wrote to memory of 2548	4044	Unicorn-6142.exe	106
PID 4044 wrote to memory of 2548	4044	Unicorn-6142.exe	106
PID 3088 wrote to memory of 5060	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	107
PID 3088 wrote to memory of 5060	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	107
PID 3088 wrote to memory of 5060	3088	23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe	107
PID 3548 wrote to memory of 3960	3548	Unicorn-61783.exe	108
PID 3548 wrote to memory of 3960	3548	Unicorn-61783.exe	108
PID 3548 wrote to memory of 3960	3548	Unicorn-61783.exe	108
PID 2080 wrote to memory of 4052	2080	Unicorn-17098.exe	109
PID 2080 wrote to memory of 4052	2080	Unicorn-17098.exe	109
PID 2080 wrote to memory of 4052	2080	Unicorn-17098.exe	109
PID 4860 wrote to memory of 4380	4860	Unicorn-20902.exe	112
PID 4860 wrote to memory of 4380	4860	Unicorn-20902.exe	112
PID 4860 wrote to memory of 4380	4860	Unicorn-20902.exe	112
PID 3372 wrote to memory of 760	3372	Unicorn-9671.exe	113
PID 3372 wrote to memory of 760	3372	Unicorn-9671.exe	113
PID 3372 wrote to memory of 760	3372	Unicorn-9671.exe	113
PID 3632 wrote to memory of 4504	3632	Unicorn-41322.exe	114
PID 3632 wrote to memory of 4504	3632	Unicorn-41322.exe	114
PID 3632 wrote to memory of 4504	3632	Unicorn-41322.exe	114
PID 2656 wrote to memory of 4452	2656	Unicorn-25540.exe	115
PID 2656 wrote to memory of 4452	2656	Unicorn-25540.exe	115
PID 2656 wrote to memory of 4452	2656	Unicorn-25540.exe	115
PID 4092 wrote to memory of 4548	4092	Unicorn-44482.exe	116
PID 4092 wrote to memory of 4548	4092	Unicorn-44482.exe	116
PID 4092 wrote to memory of 4548	4092	Unicorn-44482.exe	116
PID 1068 wrote to memory of 4928	1068	Unicorn-59090.exe	117
PID 1068 wrote to memory of 4928	1068	Unicorn-59090.exe	117
PID 1068 wrote to memory of 4928	1068	Unicorn-59090.exe	117
PID 2548 wrote to memory of 2192	2548	Unicorn-61742.exe	119

C:\Users\Admin\AppData\Local\Temp\23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe
"C:\Users\Admin\AppData\Local\Temp\23c8321280ed2e75799041d3a96e55b85daf70995c84233586bbabce0f81c71e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        9⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19078.exe
        10⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12440.exe
        11⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15179.exe
        11⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        11⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        10⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
        10⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        10⤵
        
        PID:18404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12693.exe
        9⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        9⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
        9⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        9⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53888.exe
        9⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52316.exe
        10⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-998.exe
        10⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        9⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        9⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64505.exe
        9⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55891.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        9⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13504.exe
        9⤵
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40862.exe
        9⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30199.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        8⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31902.exe
        7⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        9⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        10⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        10⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8180.exe
        10⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        9⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31026.exe
        9⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
        9⤵
        
        PID:18076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27126.exe
        9⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
        8⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54023.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63960.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23215.exe
        7⤵
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29706.exe
        9⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29478.exe
        10⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8149.exe
        10⤵
        
        PID:20040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
        9⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22799.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        9⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15485.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41081.exe
        8⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        8⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        8⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40401.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22685.exe
        7⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        9⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        9⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        9⤵
        
        PID:19404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
        9⤵
        
        PID:20376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        8⤵
        
        PID:16840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51301.exe
        8⤵
        
        PID:20256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23375.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        7⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
        7⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44905.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63016.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8687.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        7⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        7⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        6⤵
        
        PID:18760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16958.exe
        7⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        9⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        9⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29850.exe
        9⤵
        
        PID:18528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        9⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22769.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2144.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        8⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37556.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        7⤵
        
        PID:17788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33934.exe
        7⤵
        
        PID:18640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        7⤵
        
        PID:20280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        8⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        8⤵
        
        PID:16976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
        8⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
        8⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27993.exe
        8⤵
        
        PID:19984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35923.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64504.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        
        PID:10988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18111.exe
        7⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32600.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36968.exe
        6⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57474.exe
        9⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        9⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43472.exe
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27236.exe
        9⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
        9⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1907.exe
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        8⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39240.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50795.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29711.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14133.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8226.exe
        7⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        6⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4806.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        6⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39576.exe
        8⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50784.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        7⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22320.exe
        7⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31551.exe
        6⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4781.exe
        7⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        7⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42949.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        6⤵
        
        PID:19200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
        6⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50438.exe
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23348.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28069.exe
        6⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        6⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27374.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11415.exe
        5⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34824.exe
        5⤵
        
        PID:16464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18856.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6275.exe
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54080.exe
        8⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        9⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        9⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53420.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3599.exe
        8⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57889.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11288.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1828.exe
        8⤵
        
        PID:18352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45227.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        7⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1297.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        7⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42484.exe
        6⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
        5⤵
        Executes dropped EXE
        
        PID:2044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 716
        6⤵
        Program crash
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7479.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        6⤵
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28455.exe
        5⤵
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40856.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50590.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51200.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        7⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        7⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51293.exe
        7⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22973.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37862.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23344.exe
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        7⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23977.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36789.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        6⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48516.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60764.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        6⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43421.exe
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51459.exe
        5⤵
        
        PID:17960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        5⤵
        
        PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23510.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31366.exe
        8⤵
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53571.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        7⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48633.exe
        7⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31413.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
        6⤵
        
        PID:18444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52710.exe
        6⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65159.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        5⤵
        
        PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44182.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50043.exe
        6⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20856.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51806.exe
        5⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        5⤵
        
        PID:19212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
        5⤵
        
        PID:20444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45208.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61887.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52838.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37656.exe
      4⤵
      PID:13424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37570.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        7⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        9⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45290.exe
        9⤵
        
        PID:20124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        8⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19902.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10468.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12860.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42652.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9738.exe
        7⤵
        
        PID:20368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        6⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        6⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1176.exe
        5⤵
        Executes dropped EXE
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1807.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42690.exe
        8⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:18664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        7⤵
        
        PID:20272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        6⤵
        
        PID:18676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        6⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62366.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43686.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        6⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63063.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65403.exe
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        5⤵
        
        PID:18692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11296.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7995.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53800.exe
        8⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4454.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56406.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        7⤵
        
        PID:18980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        7⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        7⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58568.exe
        7⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        6⤵
        
        PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18942.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13862.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23829.exe
        5⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9352.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        5⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        5⤵
        
        PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31439.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32308.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        7⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        7⤵
        
        PID:19128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8321.exe
        6⤵
        
        PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14509.exe
        5⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        5⤵
        
        PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10909.exe
        5⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64848.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48377.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        6⤵
        
        PID:18656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        6⤵
        
        PID:20244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        5⤵
        
        PID:16876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16876 -s 424
        6⤵
        Program crash
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25766.exe
        5⤵
        
        PID:19028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        5⤵
        
        PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21029.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29917.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      4⤵
      PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8119.exe
      4⤵
      PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
      4⤵
      PID:3748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44672.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1750.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-178.exe
        7⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
        5⤵
        
        PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15704.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64313.exe
        5⤵
        
        PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23079.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39934.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        6⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59934.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        7⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44754.exe
        7⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28672.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40156.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53105.exe
        6⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20592.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7391.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        6⤵
        
        PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64556.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12170.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56794.exe
        5⤵
        
        PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40821.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43328.exe
        5⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        5⤵
        
        PID:11408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9970.exe
        5⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        5⤵
        
        PID:396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61687.exe
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41636.exe
        6⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29592.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        7⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16165.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        6⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29134.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63036.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        5⤵
        
        PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51496.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        6⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        5⤵
        
        PID:19400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14448.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      4⤵
      PID:12448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      4⤵
      PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28860.exe
      4⤵
      PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53665.exe
        6⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32475.exe
        6⤵
        
        PID:18148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        6⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        5⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63841.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12563.exe
      4⤵
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        5⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        5⤵
        
        PID:18564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7792.exe
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41946.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
    3⤵
    PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        5⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64039.exe
        5⤵
        
        PID:19392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63685.exe
        5⤵
        
        PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15739.exe
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
      4⤵
      PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
      4⤵
      PID:18376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58892.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34813.exe
      4⤵
      PID:20212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
    3⤵
    PID:11024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32976.exe
    3⤵
    PID:14860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47384.exe
    3⤵
    PID:7328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36610.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27490.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42238.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        10⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        10⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26115.exe
        10⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44049.exe
        9⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-520.exe
        9⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55768.exe
        9⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61843.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        9⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59793.exe
        9⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55839.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        8⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        8⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23759.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-312.exe
        7⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24201.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34864.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2797.exe
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        8⤵
        
        PID:18968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64969.exe
        8⤵
        
        PID:20384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58273.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60889.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2273.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33935.exe
        7⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50470.exe
        7⤵
        
        PID:18608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64962.exe
        7⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29478.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49841.exe
        8⤵
        
        PID:18716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55709.exe
        8⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        8⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        8⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        7⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54199.exe
        7⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55938.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        7⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        7⤵
        
        PID:18688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        7⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30749.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46598.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57422.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60022.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        7⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45383.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        6⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        7⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36281.exe
        6⤵
        
        PID:18404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31988.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16490.exe
        6⤵
        
        PID:20260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64531.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9471.exe
        6⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39427.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40986.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15563.exe
        7⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
        7⤵
        
        PID:19040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15960.exe
        7⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5727.exe
        6⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14027.exe
        7⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13514.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14307.exe
        6⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53788.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        6⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        6⤵
        
        PID:18992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:20308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18314.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        5⤵
        
        PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19544.exe
        5⤵
        
        PID:18972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        5⤵
        
        PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47427.exe
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17864.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31558.exe
        6⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        6⤵
        
        PID:20304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14552.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56188.exe
        5⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31796.exe
        5⤵
        
        PID:19448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        5⤵
        
        PID:20424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11656.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        6⤵
        
        PID:180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
        6⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
        5⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65052.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13169.exe
      4⤵
      PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
      4⤵
      PID:20028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11236.exe
        8⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1583.exe
        8⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
        7⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61215.exe
        7⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10094.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        6⤵
        
        PID:19356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11324.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        6⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52726.exe
        7⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        7⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43457.exe
        7⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25356.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        6⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61162.exe
        5⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24361.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        5⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13242.exe
        5⤵
        
        PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
      4⤵
      PID:5216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 604
        5⤵
        Program crash
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40192.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        5⤵
        
        PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28839.exe
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
      4⤵
      PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50844.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58758.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22524.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        7⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        7⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        7⤵
        
        PID:20292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60776.exe
        6⤵
        
        PID:18540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        6⤵
        
        PID:20352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45123.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45253.exe
        6⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        6⤵
        
        PID:18960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        6⤵
        
        PID:20320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1175.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56275.exe
        5⤵
        
        PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30536.exe
        6⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2513.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        7⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62112.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39291.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44651.exe
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
        6⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19170.exe
        6⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56964.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        5⤵
        
        PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11411.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51693.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7805.exe
        5⤵
        
        PID:7136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54928.exe
      4⤵
      PID:6728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59479.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27350.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        6⤵
        
        PID:18360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46832.exe
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:19940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3358.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35343.exe
      4⤵
      PID:17868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17539.exe
    3⤵
    PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16774.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8626.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4691.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      4⤵
      PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
      4⤵
      PID:17804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
      4⤵
      PID:9952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
      4⤵
      PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
      4⤵
      PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38175.exe
      4⤵
      PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35286.exe
    3⤵
    PID:9592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56048.exe
    3⤵
    PID:17780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1536.exe
    3⤵
    PID:6740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37386.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56348.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47313.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60358.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59685.exe
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15304.exe
        7⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18672.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34795.exe
        7⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47184.exe
        7⤵
        
        PID:20340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        5⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61798.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54582.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        6⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46857.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33328.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45720.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
        7⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40348.exe
        6⤵
        
        PID:12628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        6⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5087.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21096.exe
        6⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33425.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38865.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        5⤵
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58439.exe
        5⤵
        
        PID:19380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28349.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        5⤵
        
        PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12336.exe
      4⤵
      PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30848.exe
        5⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        5⤵
        
        PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
      4⤵
      PID:16100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18135.exe
      4⤵
      PID:388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14443.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        7⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32922.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        7⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39694.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24266.exe
        6⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63213.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3904.exe
        6⤵
        
        PID:18552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52653.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47976.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10112.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35985.exe
        5⤵
        
        PID:13664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43700.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6399.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64225.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35506.exe
      4⤵
      PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41981.exe
      4⤵
      PID:12876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32500.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
        5⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17454.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18879.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
        6⤵
        
        PID:18628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
        6⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        5⤵
        
        PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34651.exe
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
      4⤵
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
      4⤵
      PID:18924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39049.exe
      4⤵
      PID:12808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18288.exe
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
      4⤵
      PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        5⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22030.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31194.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34169.exe
      4⤵
      PID:16832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14090.exe
      4⤵
      PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33281.exe
    3⤵
    PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
      4⤵
      PID:20164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
    3⤵
    PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
    3⤵
    PID:14468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
    3⤵
    PID:15176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 640
      4⤵
      Program crash
      PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62629.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 720
      4⤵
      Program crash
      PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38620.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64853.exe
      4⤵
      PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47538.exe
      4⤵
      PID:19012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2798.exe
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54164.exe
    3⤵
    PID:11352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6212.exe
    3⤵
    PID:16108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
    3⤵
    PID:8256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50840.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50840.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62082.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2653.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44624.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29082.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39415.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        5⤵
        
        PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
      4⤵
      PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        5⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        5⤵
        
        PID:19368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36380.exe
        5⤵
        
        PID:20360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
      4⤵
      PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11210.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        6⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        5⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3084.exe
        5⤵
        
        PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9238.exe
      4⤵
      PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4651.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34535.exe
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31351.exe
      4⤵
      PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
      4⤵
      PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14125.exe
    3⤵
    PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
      4⤵
      PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
      4⤵
      PID:5812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48273.exe
    3⤵
    PID:10184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6629.exe
    3⤵
    PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
    3⤵
    PID:8888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57029.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29602.exe
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43961.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
        5⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15808.exe
        5⤵
        
        PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42660.exe
      4⤵
      PID:8608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
    3⤵
    PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
      4⤵
      PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
      4⤵
      PID:12904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
    3⤵
    PID:10144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50105.exe
    3⤵
    PID:13644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
    3⤵
    PID:10632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3521.exe
  2⤵
  PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
    3⤵
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
    3⤵
    PID:19352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
    3⤵
    PID:20392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34585.exe
  2⤵
  PID:8120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
    3⤵
    PID:13372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
    3⤵
    PID:2104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27828.exe
  2⤵
  PID:11360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-612.exe
  2⤵
  PID:16080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36888.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:20144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4232 -ip 4232
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2044 -ip 2044
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3856 -ip 3856
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5216 -ip 5216
1⤵
PID:6456

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13475.exe

Filesize
468KB

MD5
08d79b2bb8b26800f91814fc6c1a4b01

SHA1
35b11b5f05fcc41127843411583c0c5491697c13

SHA256
bdbd9d386175058a299599dcd52d57f6c3a6f944d97c4c85d303269cb3c02c80

SHA512
b377443d42fa3997f20e27f20a1984699d3514f90107f22ff517fb133b004a0968e76b0994003d33426953955a0003f9e96f1548d088f25205c38c2a493a2308

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe

Filesize
468KB

MD5
a6214f0f63ec7f9ef6d91e12928056c3

SHA1
093974f2df9ddc6c50f56e2a1ca6fe6169026352

SHA256
9a5b6a927064e08040e2e25eb22683f6844b98fe6bfe65c866e42a6336109335

SHA512
97fd6c3ec7da1ef7b179ea1d87f2eea09c18fbd18a35283ec4a0076b9697a5ee997109fe8295122c1d4cfa1f2539019e64853d13e26d8c2ebe037d2378841b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19877.exe

Filesize
468KB

MD5
4767185a883cdb37c44d5bed9b4830e8

SHA1
a373f0141d7f42a02a3efcaf2d77b05e2134709d

SHA256
a15497bb0e4cf463e36134b2c014bc964648284693ec035f0114ce3c4b550005

SHA512
78aff6de954012087429ebf0d5bf47662f8f4a0a4a395495b0a8e8450fd0754b2834c7bfb39eab9440d41be311e1eb82c9b96479d6718fa7f0e943b8503188fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20902.exe

Filesize
468KB

MD5
1b2bec9e1c1b7c898f580a97892d147c

SHA1
bb083a49a638fb020f8a1e1907b125246a010581

SHA256
5ad2385136e11fd8b8a502f76296f6586969c40d5c5e17bc8e88e97cfa131e6b

SHA512
ea17fad150204439d831db46db3a72a2f6721acfd6588144cf0b123506c84cd7ded715d3b4335a46311550776991354a665e82345c5d5676e24c8ff68a9570ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe

Filesize
468KB

MD5
aeb10e6c4e41964fba8b3c0b4d87766f

SHA1
8206a6b77832a727a4f0a781a2a141ecde221f33

SHA256
c533fbc1f6a3ddcc60df22ae740c0595dfc23f3572cf886e410be9ce28b75def

SHA512
0089e8e26c9f62767350487f1d8146182f5a2d5b8e07609a3860bb110b81b2aa873781ea5870a393475c5e7591d72f2f8cf64937b554e3171568a29d499b956b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe

Filesize
468KB

MD5
84bcfea137a51256bb9675d5021225e7

SHA1
7034c6cdb03fdf1eb1f3b11559662269f14e214f

SHA256
8660d069fdd6bbdd122e67d0089cca5df0f7cb5ed6b1cd29183e15a3682b0275

SHA512
dd8929cfa9fd73b437996d2ac3a867e14562bdf4e4acb0ca413fd65e62b0830fcc4e48663793f7155d82b1bb36d4b72748104b07ae7eba3e8f5704b1c8a1f47e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe

Filesize
468KB

MD5
8ee8b2308d7b443e37826b3e52202bb5

SHA1
7904fcfd1950b6dcc4d99036cb3ddf6f3b19c5f7

SHA256
c4b89082b8550cbd696b0b766228cb40be4a1ff34bc389b25698e89f32232215

SHA512
6b82d2393e52c9891dad757b0541586c4173d9d494018017aeed9a1fab9c91df5eb5ee84dca4839bec5971b2b87207054301eeff321c7bd12b89ee474af82810

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25540.exe

Filesize
468KB

MD5
db1b00046fea311fa93f8bc1ee58f7ce

SHA1
b6db33a9325f2994fbc02690ab21b4a81deaad53

SHA256
ea9d0d53fd7607bda229c8368f5def2ddd2fa8c9071055640f4525de7ba90b09

SHA512
46bce51254abbfa9fd7f852a5479ca614fed5813ab63df136c16b99672cd8869763d4722243412590fc7ff3f965acd40ea68855514206ff426b7c059971e49c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe

Filesize
468KB

MD5
cd7b22710ebde49f7fcd4d035128540f

SHA1
68fac9df2d67f5e7ed3e8ca1d89e83e2c228b9c5

SHA256
906c8a0959357ac6286a63de6b60bb707b00aca326e3bbaca59fa80fe9c22607

SHA512
5de2f26266b634312b1681017fc72706861ef69a1ca4e424df84e5f67aee0443d9a06829578134d289e92518c9f5a4ad657ede70a9ad6b9d6e15f21e4123f7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32504.exe

Filesize
468KB

MD5
888c9aea719873081b3df6dfac87ac6a

SHA1
e08eccdf48bc23e255ac6ba760cc8de1d25f4087

SHA256
3f85fd7aa392e7a8a892282068123e5af693a7ab6e757230544371a24800f841

SHA512
26b458579fad8a0895526d3dc8794fd8102c3ab33daaa5d6c28c481cb46e4bfa0e46b3c58a0a3f4a6bcbb4ece3f70b5d808da0334a77c5ca8e828b317030078e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33708.exe

Filesize
468KB

MD5
a8e2217f6bcac8d21e5229fd9d2e0489

SHA1
e87340b5863f47a619b3d16de8e780a2c7eba2c2

SHA256
bca4910d932dbe8f028ebe2efaaf58092eb963bef469d502bfc7e5b72bceb72b

SHA512
b1557b0550414f36e88e372384d5df00b73d55ac80b7a681a27ad1653643aa78c1667b71cde2677bc56031ce76b50faccc15278c234340b371497fd6dbc7597b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41104.exe

Filesize
468KB

MD5
1d3a90f7367b562118830ae89842775a

SHA1
a7b1d32686df334b495506eae4ef921f35c02e88

SHA256
4a9f4ad652d12df990a7cb078cfb451f43226b89e417f02c20dd8b87c59730af

SHA512
9df098990668bedf5f0c9adb2365034f9a777b06f44123b5e7216ea1549e02725c2643f7dca915cfa651734b5435a8add435caac77f0e5b9f8c95cc0328bce68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe

Filesize
468KB

MD5
af9e5492e18bd3ea84a4009ae0d3fba2

SHA1
b0186f4923882489dd510a1a0f66b6058ca3fe88

SHA256
a06eb2e6ff68b07e3f8502c5cd01a5b176ea00cb97342c8b03252e420a898624

SHA512
39b7212a9432866fdcdb7af657a82c940f16da0129fd58a8d489a544a52ab59e8de2f9ba63bef974750c1ed9d8d344a47b3bb0732be643c0eb4d1fd012d5ca0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43334.exe

Filesize
468KB

MD5
c4c5f4bfaa702b6ea7b7e1cf153607df

SHA1
a18f98a056fff018d6fc9813ef2e6c043c33c019

SHA256
23b1c672dc892d8aa36edc762c7f73b636c1310ff84bef9612b0c2d28076d1bb

SHA512
f8cdb258c48377822ee6f32f9800664f63086397594971ae4377a828495fa18162df1ca7c4862919ba99097756180e7fd8f28344707f9ea826243f6efb04848c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe

Filesize
468KB

MD5
aabd8850b93680783f7a03e346a416e5

SHA1
91b6023e107310706c0c823aee1e889ded540f2b

SHA256
d5506d90bc2c87ca751fd63f6f3d514703e1eff5574545fe8e95ee7dca610958

SHA512
bdbbf9f76d68c632930f55bb9420c017023e89326fa0de51df7d8598ba9a010ed88703c862cf07affac202b1dba7a3ff61b8387a76e1ad5e424091309c01b36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-455.exe

Filesize
468KB

MD5
3837078a58954769194f33109dbb8ef4

SHA1
2599a40662670fd2c3acb5bece01b874908fc0b5

SHA256
d1663e633b2eec17a358730e6d58271e8ed29f2525d5e45649e19e87038e64ed

SHA512
1a9794f262279789e3d47e00745cc8427333a453b89aabd167fe38c635d53412c134b4f27dcec34bfa6536e8013ab631cac177b4ae15c86e31ab36574d6b00fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe

Filesize
468KB

MD5
3ed8de2991fee1867a29a8a3659285f6

SHA1
8ca37201bc8407c3447041ed01c0293c5580da39

SHA256
fd3d56995417b343d5d808df610bf8d1b7341c33e8dfdc459eb3cbbe27b9fa38

SHA512
694bccfc904d3a6ec87ca9f03a54827b5e0554b7734cd75daae4591f5e5cffb75dc66b0289dbe452b4fcf271c4f5b71225c165b38c3c67a494423f1d5eb1678b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47689.exe

Filesize
468KB

MD5
5adabbcd0995acd06f5ca70e46309bda

SHA1
26264c2259ce059dbcf2a2ab0ce01b5c65375ed0

SHA256
801fb204ff9e59eb5d77638586d44a9ef732a3e43e857f2dc8b172799100f017

SHA512
be0acca8746ff7837fb7d7d2f9b651cadad3f00e148e855156d0b9967e49aeaf61ec01ce172bce8e28a7cf7eadc63406a76031dd793afd65f3e41d1b24917636

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48073.exe

Filesize
468KB

MD5
586e82bad3cc8c5b013d7f201f88a218

SHA1
d27675f64b18601cd7da23ef0e081e18f8b32127

SHA256
996fe6bfcc523d897d6f69881b275e6d16d6381496b0bcb3a4db0293b412fb48

SHA512
149af0abecb4a4212276c1fb76ddfa2ae19d8ceea206a517c428c3cd1b0f1984f78607822f37733c9607d22447e1da34b6f58f293dd07d96861eb9d89c4daac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50840.exe

Filesize
468KB

MD5
cd97d3d25b8da9efc372a6b37c792e97

SHA1
9b9fae7f0b862a647b4c16396c249ca303555aa1

SHA256
ba2893f31645ed05a044b3cce22a62cd9ce89f68d42251985b90f564cdcbacf0

SHA512
7459df7695022cbcae40728bab4d6cd3aa998dd9c934a067c7607619c7aa3f2cafe7dc1960a53eb65181020d25e212fe2489d90615eac1efe541d648be1f5f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5094.exe

Filesize
468KB

MD5
b20b204769c7fd7b7bfe3c5ace5aa9fb

SHA1
e182d2c0e127a4771aec79e2551db01b4afab331

SHA256
2960657e7c3bdcccd173a4a17e9de70750589a2a268bf05ce31eb9d4905cd5e6

SHA512
886fa9ff99414a78b2b54429f88b669a43937a33a38c41c536e94d87080709bdd9a281b52e38e8f8a03bc2671c96a13cb37257d1033b93b987658376040e4125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57824.exe

Filesize
468KB

MD5
d4bb529d26af0b5acde8a53198fc23bb

SHA1
f0302ca0ac0c2c171da720fa135e1d250a0e93a4

SHA256
a8b65038b4b4eae80817b33488f5c364a55d3f144368d653476518899e4eb6e7

SHA512
39ef6a53309f789d5d5a518c9f3d0b55fd4e186448aecfb0be1e1e5710c3b04184854aa969f15939a86cd56727c494995866b1d89f73125426851d49372ef91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59090.exe

Filesize
468KB

MD5
414ca1cd80c5e4d78d34853afcf5bf26

SHA1
dc237b320844d7d4fc138e94e1cf6503063452ec

SHA256
6cc8c518f901f4c85ba4f00e844be01fbea8cf5294b0f1341e685650f725adb7

SHA512
ea279e22f76dbb94a7ac15bf2ff8a3a9d4b198c5375787dd8664815b6d3752f05012d16a84ec0b4466e1931c9a3c72096c986259b87a458ac8ed3db1363cba57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59505.exe

Filesize
468KB

MD5
3a23fd8e2c51b45f498a7dd6181c5c46

SHA1
031c437e807a828023900abcb872da19c2b27aa5

SHA256
a7a6ad3975c1d9cd7d47a71c577f15e91f37c2170ae44437c3f83e9710525f57

SHA512
7b01419430042494a8716cfa4163c8098571868d2aabf72c6d539a3571b1727f0f0a2219b3678fa2f6e6ccaf0a6664307e3996af1be5bc976c4373376ee87b70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6142.exe

Filesize
468KB

MD5
6c165cb3e81a4ee3163cc70c4494c725

SHA1
347cd7a3857b53f383314b76709e089f80646efd

SHA256
d7e4d26df638c41d6fc58ee12969148a83d26d10afabf440c205a0cde48112a0

SHA512
4f55eb2cca3a72d40949f235d0ce87b3bdccc8d20df24e6a9e354234a4bd5e53f021c376233321cca782e7f999fa8942104b9f42fef4b772f43e7e0cffab0ac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61742.exe

Filesize
468KB

MD5
38cc8882a27de6c0a77248172d32b99e

SHA1
efa39ba11cca42b2e569e6563f1bc186f50511c6

SHA256
09118db20c6f6fccf514dcfe78f0a3ed29705c28bd746fa607dc74f911005c81

SHA512
288ce0f142f479034a8057b9a8aa4f28a457d632b28e7b18f28349fa585709d6355aa2716d35374758059016569efec28ed53f5d961da8c3745d93760c0c23ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe

Filesize
468KB

MD5
bd30ee0bbd250755c29b1694cc09ee23

SHA1
c9c98f1b926364bc7e0b4111e87b1570c996248c

SHA256
9314863461ad46ea4fdbf0e6aa2a9e8283181e77c9137aedbc1cd55b3437a2e6

SHA512
f6ab06acea707f6711c6ba7825be1031407884f759e52786df9d240f781181974bff94fdbff26506dc270d29d5305e5694df82c75967f2e484eebb16527d6cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7232.exe

Filesize
468KB

MD5
303166ff6a103f995acaaa4fb393cef3

SHA1
e5789d79a481cee65c5094405c013df89a39c337

SHA256
34ec2eef09fba4586cb0c8b77abfd3c662cc257d9227688d7ca3fd0152c7e2d3

SHA512
d4c69683facdbbf0f0d40ac5cc84e47ecd391e832e79cdc1fe5b7970038be19bed956d17806488535adace80ae8b1040d301d0da02382b779281078edf1e170b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8623.exe

Filesize
468KB

MD5
0e6b70a412db4e7053ff769c377ba776

SHA1
72f4b9c3cfc1e97085791d94030548c5acc36a40

SHA256
87a78dfc02650b69d1dec1d207061e43322441286a242d9dcea074410279e612

SHA512
9167b30d0d5a1fae0a13071a768e8ec0d99a877a6c0c202d9a920a6c6df13d9a1ecf5545c62210ec24b568fdd6166c196b1e2fcf03758076dff7a329dd7f20ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9671.exe

Filesize
468KB

MD5
c7a1bab8979c53818fba29386fc43ec5

SHA1
baa313b8a1dbb0096606afa3acff1cf68ff7b73e

SHA256
fa8df6d0637964f8750a1934b3d479cf40881392b1e23f1e1ec9443ad13b2c3e

SHA512
5ce34ebbfe24966450b5115ea6623fc5dada7b0703b0bd0da1910fdfdeb589cc3376a613b3f4cc354320f37074fbab866b8755a7c5cb949d7a53e53e61297d56

Download Submit
memory/12464-3503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads