04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe
Size

468KB
MD5

8ab33c0082e13b7f8eb6beccc21d2a60
SHA1

89cf21de03d176368b523dcef8987d5a8ed83b04
SHA256

04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040
SHA512

62c2fd8b9e1d934f7846e969a8fa188fb50960fafbf3edc3e2a6044323e767d14ddd675bd49caa4740d38212aaa4f14789b0cb2550c28cfcdd987659d9f3c507
SSDEEP

3072:tqmhogKxjU8I/bY3Pz3C3f8/EGhc7IpldmHBzVpBELE36joNp8lf:tqIotZI/cPDC3fF0W9ELqUoNp

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2648	Unicorn-59526.exe
2756	Unicorn-39791.exe
2964	Unicorn-52022.exe
4452	Unicorn-9861.exe
1108	Unicorn-55428.exe
1304	Unicorn-41692.exe
3160	Unicorn-52461.exe
4500	Unicorn-9166.exe
1984	Unicorn-58045.exe
2956	Unicorn-28902.exe
4836	Unicorn-12565.exe
1652	Unicorn-47469.exe
3256	Unicorn-41604.exe
3916	Unicorn-10645.exe
3372	Unicorn-20851.exe
2628	Unicorn-27942.exe
8	Unicorn-56893.exe
4116	Unicorn-46655.exe
4080	Unicorn-16998.exe
4456	Unicorn-16998.exe
1956	Unicorn-26627.exe
2796	Unicorn-40029.exe
3692	Unicorn-48694.exe
3832	Unicorn-31340.exe
4424	Unicorn-59670.exe
5040	Unicorn-10204.exe
4764	Unicorn-10469.exe
1532	Unicorn-42300.exe
4560	Unicorn-12389.exe
3788	Unicorn-58061.exe
1200	Unicorn-47366.exe
1848	Unicorn-41236.exe
3164	Unicorn-42004.exe
2264	Unicorn-50511.exe
1608	Unicorn-4517.exe
2128	Unicorn-50381.exe
5104	Unicorn-4709.exe
2904	Unicorn-4709.exe
4596	Unicorn-50381.exe
3304	Unicorn-8517.exe
3444	Unicorn-33983.exe
5088	Unicorn-36998.exe
3672	Unicorn-23158.exe
1124	Unicorn-36156.exe
4612	Unicorn-691.exe
4264	Unicorn-28067.exe
2192	Unicorn-55757.exe
1112	Unicorn-64390.exe
3096	Unicorn-64390.exe
4776	Unicorn-64390.exe
2136	Unicorn-46575.exe
1688	Unicorn-26709.exe
668	Unicorn-46575.exe
1332	Unicorn-7004.exe
1504	Unicorn-13134.exe
4332	Unicorn-58806.exe
2240	Unicorn-13134.exe
4340	Unicorn-16268.exe
116	Unicorn-6620.exe
3500	Unicorn-58422.exe
4064	Unicorn-12428.exe
3276	Unicorn-6508.exe
4844	Unicorn-18838.exe
3528	Unicorn-17996.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4504	2956	WerFault.exe	98
4388	4836	WerFault.exe	99
1016	5040	WerFault.exe	119
6452	7720	WerFault.exe	362

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54774.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46326.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1664	dwm.exe
Token: SeChangeNotifyPrivilege	1664	dwm.exe
Token: 33	1664	dwm.exe
Token: SeIncBasePriorityPrivilege	1664	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe
2648	Unicorn-59526.exe
2756	Unicorn-39791.exe
2964	Unicorn-52022.exe
4452	Unicorn-9861.exe
1304	Unicorn-41692.exe
1108	Unicorn-55428.exe
3160	Unicorn-52461.exe
4500	Unicorn-9166.exe
1984	Unicorn-58045.exe
4836	Unicorn-12565.exe
3256	Unicorn-41604.exe
1652	Unicorn-47469.exe
2956	Unicorn-28902.exe
3372	Unicorn-20851.exe
3916	Unicorn-10645.exe
2628	Unicorn-27942.exe
8	Unicorn-56893.exe
4116	Unicorn-46655.exe
4456	Unicorn-16998.exe
4080	Unicorn-16998.exe
1956	Unicorn-26627.exe
3692	Unicorn-48694.exe
2796	Unicorn-40029.exe
3832	Unicorn-31340.exe
5040	Unicorn-10204.exe
4424	Unicorn-59670.exe
4764	Unicorn-10469.exe
1532	Unicorn-42300.exe
4560	Unicorn-12389.exe
3788	Unicorn-58061.exe
1200	Unicorn-47366.exe
1848	Unicorn-41236.exe
3164	Unicorn-42004.exe
2264	Unicorn-50511.exe
1608	Unicorn-4517.exe
2128	Unicorn-50381.exe
3672	Unicorn-23158.exe
2904	Unicorn-4709.exe
4596	Unicorn-50381.exe
4612	Unicorn-691.exe
1124	Unicorn-36156.exe
3304	Unicorn-8517.exe
3444	Unicorn-33983.exe
2192	Unicorn-55757.exe
4264	Unicorn-28067.exe
5088	Unicorn-36998.exe
5104	Unicorn-4709.exe
1112	Unicorn-64390.exe
4776	Unicorn-64390.exe
3096	Unicorn-64390.exe
2136	Unicorn-46575.exe
1688	Unicorn-26709.exe
4332	Unicorn-58806.exe
1504	Unicorn-13134.exe
668	Unicorn-46575.exe
4064	Unicorn-12428.exe
2240	Unicorn-13134.exe
3500	Unicorn-58422.exe
116	Unicorn-6620.exe
1332	Unicorn-7004.exe
4844	Unicorn-18838.exe
4340	Unicorn-16268.exe
3276	Unicorn-6508.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2648	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	82
PID 4796 wrote to memory of 2648	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	82
PID 4796 wrote to memory of 2648	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	82
PID 2648 wrote to memory of 2756	2648	Unicorn-59526.exe	85
PID 2648 wrote to memory of 2756	2648	Unicorn-59526.exe	85
PID 2648 wrote to memory of 2756	2648	Unicorn-59526.exe	85
PID 4796 wrote to memory of 2964	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	86
PID 4796 wrote to memory of 2964	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	86
PID 4796 wrote to memory of 2964	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	86
PID 2964 wrote to memory of 4452	2964	Unicorn-52022.exe	89
PID 2964 wrote to memory of 4452	2964	Unicorn-52022.exe	89
PID 2964 wrote to memory of 4452	2964	Unicorn-52022.exe	89
PID 4796 wrote to memory of 1108	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	90
PID 4796 wrote to memory of 1108	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	90
PID 4796 wrote to memory of 1108	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	90
PID 2648 wrote to memory of 1304	2648	Unicorn-59526.exe	91
PID 2648 wrote to memory of 1304	2648	Unicorn-59526.exe	91
PID 2648 wrote to memory of 1304	2648	Unicorn-59526.exe	91
PID 2756 wrote to memory of 3160	2756	Unicorn-39791.exe	93
PID 2756 wrote to memory of 3160	2756	Unicorn-39791.exe	93
PID 2756 wrote to memory of 3160	2756	Unicorn-39791.exe	93
PID 4452 wrote to memory of 4500	4452	Unicorn-9861.exe	96
PID 4452 wrote to memory of 4500	4452	Unicorn-9861.exe	96
PID 4452 wrote to memory of 4500	4452	Unicorn-9861.exe	96
PID 2964 wrote to memory of 1984	2964	Unicorn-52022.exe	97
PID 2964 wrote to memory of 1984	2964	Unicorn-52022.exe	97
PID 2964 wrote to memory of 1984	2964	Unicorn-52022.exe	97
PID 1304 wrote to memory of 2956	1304	Unicorn-41692.exe	98
PID 1304 wrote to memory of 2956	1304	Unicorn-41692.exe	98
PID 1304 wrote to memory of 2956	1304	Unicorn-41692.exe	98
PID 1108 wrote to memory of 4836	1108	Unicorn-55428.exe	99
PID 1108 wrote to memory of 4836	1108	Unicorn-55428.exe	99
PID 1108 wrote to memory of 4836	1108	Unicorn-55428.exe	99
PID 4796 wrote to memory of 1652	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	100
PID 4796 wrote to memory of 1652	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	100
PID 4796 wrote to memory of 1652	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	100
PID 2648 wrote to memory of 3256	2648	Unicorn-59526.exe	101
PID 2648 wrote to memory of 3256	2648	Unicorn-59526.exe	101
PID 2648 wrote to memory of 3256	2648	Unicorn-59526.exe	101
PID 3160 wrote to memory of 3916	3160	Unicorn-52461.exe	107
PID 3160 wrote to memory of 3916	3160	Unicorn-52461.exe	107
PID 3160 wrote to memory of 3916	3160	Unicorn-52461.exe	107
PID 2756 wrote to memory of 3372	2756	Unicorn-39791.exe	108
PID 2756 wrote to memory of 3372	2756	Unicorn-39791.exe	108
PID 2756 wrote to memory of 3372	2756	Unicorn-39791.exe	108
PID 4500 wrote to memory of 2628	4500	Unicorn-9166.exe	109
PID 4500 wrote to memory of 2628	4500	Unicorn-9166.exe	109
PID 4500 wrote to memory of 2628	4500	Unicorn-9166.exe	109
PID 4452 wrote to memory of 8	4452	Unicorn-9861.exe	110
PID 4452 wrote to memory of 8	4452	Unicorn-9861.exe	110
PID 4452 wrote to memory of 8	4452	Unicorn-9861.exe	110
PID 1984 wrote to memory of 4116	1984	Unicorn-58045.exe	111
PID 1984 wrote to memory of 4116	1984	Unicorn-58045.exe	111
PID 1984 wrote to memory of 4116	1984	Unicorn-58045.exe	111
PID 1652 wrote to memory of 4080	1652	Unicorn-47469.exe	112
PID 1652 wrote to memory of 4080	1652	Unicorn-47469.exe	112
PID 1652 wrote to memory of 4080	1652	Unicorn-47469.exe	112
PID 3256 wrote to memory of 4456	3256	Unicorn-41604.exe	113
PID 3256 wrote to memory of 4456	3256	Unicorn-41604.exe	113
PID 3256 wrote to memory of 4456	3256	Unicorn-41604.exe	113
PID 2964 wrote to memory of 1956	2964	Unicorn-52022.exe	114
PID 2964 wrote to memory of 1956	2964	Unicorn-52022.exe	114
PID 2964 wrote to memory of 1956	2964	Unicorn-52022.exe	114
PID 4796 wrote to memory of 2796	4796	04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe	115

C:\Users\Admin\AppData\Local\Temp\04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe
"C:\Users\Admin\AppData\Local\Temp\04088de305c775d63e5975e9db87e974e8fa559c95d6d7ab968f5220d0f05040N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36742.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        10⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
        11⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
        11⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        10⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60901.exe
        10⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        9⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        9⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29049.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        8⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
        9⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21596.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        8⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59133.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10489.exe
        9⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-856.exe
        9⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe
        9⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30517.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        9⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 648
        9⤵
        Program crash
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27996.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61772.exe
        8⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26709.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
        8⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33871.exe
        9⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53479.exe
        9⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        9⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        8⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34188.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        8⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18908.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1487.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56116.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9295.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39399.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62470.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
        9⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        9⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53856.exe
        9⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        8⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        7⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25208.exe
        8⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        7⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        7⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        7⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31529.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5836.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24259.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5583.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
        6⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44352.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32013.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46399.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        7⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        7⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10831.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23567.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41588.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21297.exe
        5⤵
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64390.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14037.exe
        7⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39487.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64534.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        10⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        10⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        9⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        9⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        9⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44135.exe
        9⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        8⤵
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23253.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25071.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        8⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3695.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14851.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7231.exe
        7⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        6⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60553.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
        8⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56240.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        7⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        6⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30399.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38368.exe
        7⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26936.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65060.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11745.exe
        5⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32663.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 464
        5⤵
        Program crash
        
        PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6101.exe
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        5⤵
        
        PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
      4⤵
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63823.exe
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        5⤵
        
        PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29070.exe
      4⤵
      PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31968.exe
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
      4⤵
      PID:8968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 480
        5⤵
        Program crash
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23158.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        6⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53711.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-165.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43759.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37210.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61792.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53849.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14888.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25135.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29241.exe
        7⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43060.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20402.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28054.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31779.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        6⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52694.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        7⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
        7⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
        7⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20917.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
        6⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14261.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        6⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30179.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50679.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        5⤵
        
        PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11852.exe
      4⤵
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        5⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18271.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44740.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21804.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60425.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64728.exe
      4⤵
      PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        8⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3688.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        7⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6019.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7714.exe
        7⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11903.exe
        7⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        7⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60217.exe
        6⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48034.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30165.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63446.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57741.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61721.exe
        7⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15032.exe
        6⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5043.exe
        5⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40409.exe
        6⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7305.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8853.exe
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19702.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25432.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42889.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11212.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6671.exe
        5⤵
        
        PID:13104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54036.exe
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50390.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
        6⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30652.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        5⤵
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42696.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33074.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44768.exe
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        5⤵
        
        PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56416.exe
      4⤵
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40322.exe
      4⤵
      PID:6624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
        5⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        7⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        7⤵
        
        PID:14916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47581.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28857.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43912.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10139.exe
        5⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        5⤵
        
        PID:12500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40357.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        6⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56361.exe
        6⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29692.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57495.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22003.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
      4⤵
      PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
      4⤵
      PID:4136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10743.exe
      4⤵
      PID:9628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28067.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8910.exe
      4⤵
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35647.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15784.exe
        6⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21560.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        5⤵
        
        PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
      4⤵
      PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16991.exe
      4⤵
      PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27528.exe
      4⤵
      PID:15944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50902.exe
    3⤵
    PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        5⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64601.exe
      4⤵
      PID:15564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
    3⤵
    PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
    3⤵
    PID:9788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33559.exe
    3⤵
    PID:14272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
    3⤵
    PID:7656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62052.exe
        9⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22470.exe
        9⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20969.exe
        9⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17496.exe
        9⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57881.exe
        9⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5884.exe
        8⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        9⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9064.exe
        9⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        8⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4840.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7227.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32784.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13974.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8219.exe
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23057.exe
        7⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38262.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
        9⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        9⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        9⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        9⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1516.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        8⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48291.exe
        8⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60580.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10034.exe
        8⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11976.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34669.exe
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3583.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22833.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5237.exe
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        9⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        9⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        9⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        8⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3577.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14248.exe
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15068.exe
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2323.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        7⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48397.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12712.exe
        7⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34211.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        6⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62246.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12520.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28784.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20383.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30774.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45318.exe
        6⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50407.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18536.exe
        6⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24639.exe
        6⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60228.exe
        5⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        6⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        5⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55543.exe
        5⤵
        
        PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46575.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        9⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6271.exe
        9⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23601.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46985.exe
        8⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40320.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35944.exe
        7⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16341.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36943.exe
        8⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50514.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43112.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62016.exe
        8⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4351.exe
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4300.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34607.exe
        7⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1795.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54774.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9183.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
        7⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26310.exe
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60554.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45640.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58422.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8302.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58544.exe
        7⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
        5⤵
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5765.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11487.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        6⤵
        
        PID:15772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24774.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58359.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37480.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19496.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        7⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10792.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        7⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        6⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20770.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11316.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61108.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30582.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51072.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22991.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38412.exe
        5⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26147.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        5⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53273.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18579.exe
      4⤵
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51821.exe
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26553.exe
        5⤵
        
        PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20620.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      4⤵
      PID:15584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55176.exe
      4⤵
      PID:16052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
        6⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1468.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43273.exe
        8⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9295.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        7⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13650.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        7⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60416.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15208.exe
        6⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5132.exe
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36927.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28697.exe
        7⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1701.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10214.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61529.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11500.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4434.exe
        5⤵
        
        PID:15036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39938.exe
        5⤵
        
        PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24438.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-917.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56128.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
        6⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36915.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14632.exe
        6⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1227.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52048.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7544.exe
        6⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
      4⤵
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24054.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55168.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1368.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        5⤵
        
        PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31544.exe
        5⤵
        
        PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
      4⤵
      PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64793.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24632.exe
        5⤵
        
        PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60739.exe
      4⤵
      PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
      4⤵
      PID:16536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36998.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        5⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30575.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-565.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37813.exe
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        6⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7077.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12095.exe
        6⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16079.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59709.exe
      4⤵
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59990.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49926.exe
        6⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21337.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        7⤵
        
        PID:16932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53863.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26918.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43504.exe
        5⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        5⤵
        
        PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62297.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
      4⤵
      PID:12468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20529.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9813.exe
      4⤵
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56015.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18169.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35567.exe
        5⤵
        
        PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64598.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56640.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55856.exe
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37616.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      4⤵
      PID:16680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
    3⤵
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56918.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63958.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43831.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22640.exe
        5⤵
        
        PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        5⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4840.exe
        5⤵
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
      4⤵
      PID:16688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25557.exe
    3⤵
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11374.exe
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
      4⤵
      PID:12436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11711.exe
      4⤵
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12936.exe
      4⤵
      PID:9856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exe
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
    3⤵
    PID:12428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18656.exe
    3⤵
    PID:17000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 488
      4⤵
      Program crash
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61135.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe
        7⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        6⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
        5⤵
        
        PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34370.exe
        6⤵
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        6⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        5⤵
        
        PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        5⤵
        
        PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
      4⤵
      PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
      4⤵
      PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17996.exe
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2341.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37180.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30648.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55312.exe
        6⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        5⤵
        
        PID:968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3848.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33936.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47607.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      4⤵
      PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41252.exe
    3⤵
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
      4⤵
      PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20495.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
      4⤵
      PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
      4⤵
      PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52733.exe
    3⤵
    PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
      4⤵
      PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
    3⤵
    PID:11968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11746.exe
    3⤵
    PID:15652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35600.exe
    3⤵
    PID:17132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10600.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20092.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50304.exe
        6⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1935.exe
        6⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2677.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59417.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39988.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21343.exe
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
      4⤵
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29647.exe
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18015.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55664.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6184.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
      4⤵
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64985.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
        5⤵
        
        PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59219.exe
      4⤵
      PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
      4⤵
      PID:16348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56383.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49215.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        7⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49293.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34505.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2008.exe
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
      4⤵
      PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        5⤵
        
        PID:15780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26729.exe
      4⤵
      PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58489.exe
      4⤵
      PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38434.exe
      4⤵
      PID:10312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
    3⤵
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22844.exe
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34201.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36671.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29007.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36623.exe
      4⤵
      PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
      4⤵
      PID:15336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14207.exe
      4⤵
      PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
      4⤵
      PID:16600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
    3⤵
    PID:10332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
    3⤵
    PID:15284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
    3⤵
    PID:16380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
      4⤵
      PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4853.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        7⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5557.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58663.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47549.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8603.exe
        5⤵
        
        PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51951.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63216.exe
        5⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62905.exe
        5⤵
        
        PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
      4⤵
      PID:15912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
    3⤵
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7717.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23769.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
        5⤵
        
        PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42556.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27385.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25823.exe
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
      4⤵
      PID:17164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44893.exe
    3⤵
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
      4⤵
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33741.exe
    3⤵
    PID:8620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4001.exe
    3⤵
    PID:16060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7374.exe
    3⤵
    PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37078.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        6⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60167.exe
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56272.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        5⤵
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21368.exe
      4⤵
      PID:9500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
    3⤵
    PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46505.exe
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64435.exe
      4⤵
      PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
      4⤵
      PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47005.exe
    3⤵
    PID:9484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
    3⤵
    PID:14292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
    3⤵
    PID:17400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47983.exe
  2⤵
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54095.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
      4⤵
      PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56153.exe
        5⤵
        
        PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19929.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11752.exe
      4⤵
      PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
    3⤵
    PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27302.exe
    3⤵
    PID:10504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
    3⤵
    PID:13776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
    3⤵
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30584.exe
    3⤵
    PID:10100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21092.exe
  2⤵
  PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56278.exe
    3⤵
    PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58736.exe
    3⤵
    PID:11884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
    3⤵
    PID:8544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5652.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
  2⤵
  PID:13268
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19137.exe
  2⤵
  PID:16008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2956 -ip 2956
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4836 -ip 4836
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5040 -ip 5040
1⤵
PID:2548

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7720 -ip 7720
1⤵
PID:16264

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:15720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe

Filesize
468KB

MD5
3f5965305ab3d442a80e859128c356e9

SHA1
819f814015ea8cf7a75842aca2c34e75a0ac4f8f

SHA256
66bee472a3edf9ff2fedfd585b33af449dfe087b1b12ab393620b26108fdf2bf

SHA512
bebf8377a0cc20503b566669b289ca1690dc18bedee5fb4493b603c1115e7aecfe43aaa890858b6be95a4d7ddbc0cae355d1f178069ce6b15032f30b67b144ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe

Filesize
468KB

MD5
44a927eb01f76b99242830ee7530fb21

SHA1
e2f5fa0ed855980923801915b963b25facade96c

SHA256
4c5f0a88c5f2998af08a2be05214777f90ff9972468e229a0adeb716fad13346

SHA512
8bccece708d7ad02179986dea1095e74df6ad5e46c9fc66f4a145904993191227526e5994e743723526f3d06c56d0ccf60a73a7f890a61643f6a717cade652d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe

Filesize
468KB

MD5
8acf1c1d257039d59721cd0d5e385912

SHA1
3201aa33dd85c8339e6e43603d7e6c46af24b385

SHA256
0a36fb7f84cb41c81f942b2a6bde3f10dd154fb69155e06ea2d75807267e68d4

SHA512
d131ea713ace6633815a53e5af12fc94bb234b435b4abb417b6a91f4cf512f88ff383d897bef40197b3c7944c2b946e900341f3530b5331b0ad8ae981d40da2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12389.exe

Filesize
468KB

MD5
9df6d7058398eb3655d9f50ab31c49f2

SHA1
716e313b88fcea20ef872efb19b1786cab932bc1

SHA256
b153f8d51ca574f0cf075961c76c1e53e94e47b42cffb7a9231cf4ccc996df22

SHA512
47074dc7bfce755b736de95cd578da8dea72b5f4f75f18847858d35f19853a58447c73c0f8b4d57289fc1a40fcadb772b9495d409dc14d4884e3ec62dd2bf614

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12565.exe

Filesize
468KB

MD5
6b9d941f06dfab69338d93a913a45ba9

SHA1
0cba55a30156f0926509e7adbabf0fc51b393ac0

SHA256
1504caaa1b2e93323bf48ddf021ad51a81be268daa5e8e067cd60fbdd328e583

SHA512
c417f9d350922c5cba15cdd704673e39b215f7faca91d8129fc93888b8d91bf7cbb53965a1162900600f0a3b73ff97a5130baa0e25d20fbc33093990d2c06ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16998.exe

Filesize
468KB

MD5
8680809d9016c8097c8a942ede260d72

SHA1
bba6dbc08432cca8f79f31625a9e183a950f18bf

SHA256
d0402469a0ae6b7dc5efb1d2a7ced3dccb0d569eb60217c4a1d1e4e74d94ff91

SHA512
dea5df6e32792e5e7ec2de6bee63eee9189b335d24009cd2831f825855dd89bdf19d6b26d2da662cf746d491a8bfd3dda01822a49d8e84b8d613d4e8e4bbb191

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20851.exe

Filesize
468KB

MD5
f6eb396ed13bcc3342af4bb95a39ca83

SHA1
07ef4e6e154db0661083b44199696531ad3d36f3

SHA256
96b957010757e460f09e0442a5b60741d398715fd50d935e1b08ee9e7744c323

SHA512
01f098f353d70362ec11ed58958c58af64ff1259e351e1b1711638a6f7066c2b9fe8e5222db33d7b186350c84f230611f56dcdab1c004bf9b094b6c985f3d6ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe

Filesize
468KB

MD5
db0a333680c1db8c23d51ca4615b365f

SHA1
7530f0e65b342cf923c30f3029a216c00d66b0da

SHA256
715f521ef25a7bbbf85eab9376c61bc1ec5f0a69e08b86d1ad541b2c22425ce8

SHA512
fa8577e9bba342a10260467c73ee540ae4f753d68836e6ce47c700dbe498c199a01f8ddf68ee23ba8894d1a084109b63978e83d99e4bf811d489e96de7292cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe

Filesize
468KB

MD5
2a8bc50c975660756a1889ff812e7fc1

SHA1
e4c1f992ca9d66089e79fb017f8ddbe532bb3f57

SHA256
d2210632d4827ca7f9d4636214144d4146d9dd0e0864c67510c1d5f82ba9017e

SHA512
654db632361bbc4e0bca17a8512af5840292696e5711214e7c58ccb8a8e2ce0aa2cc989924f02fd27a03de71e966384b2f5b12d7c547f3a428ae3283ad3268ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe

Filesize
468KB

MD5
a993386873cc58917d93ff16d981f828

SHA1
13193ffc62f8f3de1178aeb5b09c8f393d6f68e7

SHA256
83c16ef81b8ef14b4de94d499e473b598b6d3d264b3210fdc8dac141e97843fe

SHA512
6888d8ae70ebf4bd2992ef842e56fe49a7dcc14f8e8960d15336a763c388772340b7b4a9204ac22c17b9f65e90f6bdce6331597262e07a405a27b70e888cb638

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe

Filesize
468KB

MD5
06012043397d6355c40ba8fab174f5a3

SHA1
45f763b2008ae672d0b1f86c547828d742e7b70e

SHA256
24dc88f0fd8e4daee94fde4568a9d5cb6d8b708aaa5bf652015a0097a69ccfb7

SHA512
7aef14abfaaeb7ee383211f0114edabf65f197d55ca358a40f0471c1e15afe469090715900e98c07c777c173a34d52e98fac7d2ce560c76d9926b1f26291776e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39791.exe

Filesize
468KB

MD5
17c188874e0f4b4a72ec44e45d015112

SHA1
15dfad7717ed3a4faacac48cdc00ad60b28a7bd5

SHA256
842fe85d93940df8422c89708a06b32b264858d53a85f5d0bdaa2e3839a206ab

SHA512
4655fb0494aeb90474f94c4d9a02ddb7b08edb9dc0a4f66d8eed50f430be3fb88ec5b4035582ad6795403f4e52ad1fca18aa39f105c053988b50472f20ea646b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe

Filesize
468KB

MD5
72c3200224c30adf69c9906a21f50c77

SHA1
c0f74cfa1fdaa9c10e6b1f85c5b3663df0417f5a

SHA256
915a682570c4d94d3f27b0832d56ff5de8c3eb8920b22aa1b4f1d6ef2e2e8792

SHA512
f4547e65edbf80327cb3eea54609dda4f2d3fb0dfda657e52bb691216a96d6f7092568264e8149b88c4d5d2e43ccc6dbe1817ac81be85548d8d99c850d1f9567

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41236.exe

Filesize
468KB

MD5
5cc6fe393f459b0c619b76bf47b48a09

SHA1
e4a682c6a1da8da9ebc473c2ab259e0565b46b4f

SHA256
3351d2a789a82384df9f1ac36dac01e143c03801867ffe6e626a4e3292351dd4

SHA512
9c8a019967d745bbfa446c9ccee7f820dc0b3a0dc9e4fea4aafde3018e971525a5350a84ef00a3fe611a3444de4272c4d2003806b655a116bd3b85bf66584ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41604.exe

Filesize
468KB

MD5
8da785bc486210209bfb5cc8303eb762

SHA1
285ba684700fd3135da7385e47e90aae740c4e13

SHA256
94238949e499ab3d47cb34de81b91bcd72c3fe8c979b710efa50667fe3ff6142

SHA512
d9702a6762c4f0b2b489a72c697d7a49d2e27baedd59afd25e680320eedf207f78c79277ff33483432500f201dbd13eb6438f340023287980038ba6ec4454e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41692.exe

Filesize
468KB

MD5
3218efe5ef10ec5836bc1afa3836f4ee

SHA1
430ba7520b21406c22b164efa959b3c8b797850d

SHA256
786d71c45c3d193c5cba3a1654e0e0e1e67fe223dc59f4e4028408350efb9413

SHA512
d062e60cf21f924906f3f9b3988379b86d01e5f1bfc41f71abe2097ac40b3c2656e36c36a842ca32b983c918d9fd759c436f68f5a4386f4d61ce2e5fe1a2d9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe

Filesize
468KB

MD5
8226036d3cc6cc5b77b2c2e1060201ba

SHA1
a10267f47dc750e8297baef1aa3268e0f8a5bba9

SHA256
ec4c286471b0c4cc004d2f6e0c55dcb79ac7018784c5765744cd145b35f9a67e

SHA512
6cdc95cb866e38c6d7568777c7d8d737f6e1a5cbe77f6bf16a20c6d9f225789ac26b9213b3d45da1dbc87b0105951c76b5b7910b6dc2f48add62bac8c0c851dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43656.exe

Filesize
468KB

MD5
85d3ab34e5643b3e945b61fa359b1b8f

SHA1
bac8b24cf653999dafdad72e6a5b995ebd969f4d

SHA256
9e56109b4879d06b0f2f14c20b64176ae4ccd977a1efc45c4abae0f027281225

SHA512
954d69bdc4544d1b2054df260dc8c2ca228ef27253ebf0c8425fec678351ffff5df4bb7e78290d7d23b40c54dc767308c64d881642a2a1366fb40a6d6dc46d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe

Filesize
468KB

MD5
355270b18f54a140c59f870470fb6fe5

SHA1
bf729f948bbfd670232d69765ba9c3f716ef8eab

SHA256
47da51169d6fab3a3529b19f91a5fe95fe4489064fd085445fd7cee9bbfc927f

SHA512
8fc097fe7af935344b4d37ec6b30dc673848a4945eace612cbd456a242a5ce43bc0b086d2c6ac5232f26897bc21a380ddd4a34d2af6004f149391dc1b690b225

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe

Filesize
468KB

MD5
b38e6a1f021a3899293c07e7827ab8e0

SHA1
67b90cdaac6412ae469c43002ca289d378ed3219

SHA256
92d5935ea80f897c7c92bc6e3a487badad94e242b6b5d562883784e666e951ae

SHA512
116b1ba7c1da40202c957adc8408ae42082f0a04b9895755b64903a5ecb4f0ed1eb9530de66b2cdc64a788c102aa4a4aeb037eeb3df38cd935d7abc318ce5b27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47469.exe

Filesize
468KB

MD5
dcc5fd14ed0470e8ba8cdaea07615095

SHA1
495821e01fe6e0e30307ee0b6c8388175631e020

SHA256
463abb9e34b9dd8201f19f4e0352c02ecda9445971e0141738771fd8d8e5ad62

SHA512
772bb7b95623d4d7e25499d39abaed6321f923e033051a4a15ecfa457efe4fdb379f2622b8e40b5f0bf803bf10f078604326379724870a0ea051ef3711fb8ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48694.exe

Filesize
468KB

MD5
c7b5515fc278f52cd0029a31d4a0203f

SHA1
d25b57fdbe48add4c67c21398266ab0ad84fba23

SHA256
cd7e07c6f70ef1638df05ff42917c5a222d966ea31f51adfbcf033971de51bf0

SHA512
f3fb456f82dbff3bb54a68ab7f5549e58b350a04f99985e5e86cbd1b474db864fecbbd6a69defcb9333fc626849c5fc1719564c7a8faa9aec53f9e5db5defcb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe

Filesize
468KB

MD5
e3bdbbb39e692dad1f170dc3f499b447

SHA1
10c09272c2faf1aba516e90d1aadd61704046501

SHA256
0e5fd52c5866148ecc6130b81e5c506690e61698b750f1eddfdb28444e2df1a5

SHA512
fdca3e452b9ae9c06ee714bebeced6b58dad001308491ecb0061e5d50ff15c077d68feb170f6c5175e8d82434103e1ab6fb0062d95cf91e5998bfb9a8abb5592

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52461.exe

Filesize
468KB

MD5
5c1c1e138f27d7191b3ede674f4be2e9

SHA1
0cc9369e6b688ffcadfaaf8832f4ee8d871d9604

SHA256
54f54e31fa36c5490002e8b613a389482e3b27dd4e0b58460572507c519ac185

SHA512
cd04bbc575140c3043d4bcb76e725c37acfd0ee6e958060d6eb4fa4605d6c0e65585dae8131c07466b50d5f687f124350c5a3071dcc98e62cf68f883ed11624c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe

Filesize
468KB

MD5
a081fea9c68c2a71013d519a0913130e

SHA1
739c302f0c700c5d9e6796b678df932a29eae416

SHA256
fd8f5e5ea5aeb88fe19e5a8cfa6fd4ae532f42abb50e01e4018bd58426a0946c

SHA512
fd5646a14468d71a01b0ad7445e973bff1d12fc372c38a61d365cf9fd309fcf1c63392e16a417df7bbe9376b7b86096024f6a9a1d3bea7a8b59bd687d1c8d64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe

Filesize
468KB

MD5
351d62b1af7d76e958d3cd29c962e73e

SHA1
d54a29c9511b0dbcc9a510138b66f400b63d2ada

SHA256
375c49a62ae62223dbf51433da22ed3a37119353b65ff2f364b74030fcd5102a

SHA512
bb30b149c21a5d651ee358866c3372dfcbc98fda383644533d29e093835fc3b3a340fd98017224490136265565f1ac5f70032c767f1303feb05a355b9055434a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58045.exe

Filesize
468KB

MD5
ac62b6ed921c4b3338b5cfa8d77a4022

SHA1
6be6ec03c14d1b5a5631cdb259b09d6e3a18caca

SHA256
fa1d7e7bfd563f2cbc0d6dc2073382c772e46c558f494e284be6a03ef657b511

SHA512
9d7026c1a6d4ed9635b4049fdca55824b53c5e69b623920e37a14ed7ed689882341f90bceb55b314156bc2d704ff9b60b332c0a8eba939fc6a2c725ff1f8fa8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe

Filesize
468KB

MD5
7caee2141fa22eed0e415221b8cc53c0

SHA1
97c5ef86d5ed15163a756b6db001c78c4184e5d8

SHA256
1f534fbdac3e4f99c99ac841bbab43e1556045f3fb2d3b1ec544e636a45523e2

SHA512
80cf6c2699f5a15b573b1ab277e311f7082e2ca8f89bc5294656b965b5d084a58d5522d11a8c6427031ca51469d6b84016b0fc926b94bd390d2daa5664ca7e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe

Filesize
468KB

MD5
28b769fdc373425bdd8f68f0c06b3396

SHA1
dfc96de35297da10563decb90096293d03b60558

SHA256
3812e0d182eb35076852947dafa876fdfc4201159039c22c85ad0585814407db

SHA512
ad7d26083034f28840f1b20ce753bc2bfceb9f944e006d0e434a547834018d88f9b5cf1a17f0c012c67586d4d242e97e9b400be955c0f81dffd410ad65bb43ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe

Filesize
468KB

MD5
4d464d029c47b3e4b6e7727556371ecc

SHA1
035cb440afc2f945107231528f59eb0f02976010

SHA256
74a4c69031ee999f070870d56dfc3b6ad4de31a9eaaa2c9f711f184e969c4bf2

SHA512
e414c09df50954201aba7887436b4f9ce579b636ef2bbcadb81bf4e03e2c0f1c53fe1e1dd0214040f86286b00af77e0c0cbb24be31edf54f6260956b2ca71faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9166.exe

Filesize
468KB

MD5
10d406924b9f7988c93d2ca5b368dfb3

SHA1
435fae6ec1866c355ea0f3a2737e4a77d3315543

SHA256
f5a31afb677358d742edd2c346555bc2309cff21684bee34f9ac6d55442ac635

SHA512
480862242cd84bc5d7bbe59b7d7c1980eb46ac438805f2a1aa6d7b281ed9d1bf28cd57c0f5a566ca8a7831da4ec4f2e2a6b95982226dd5b9f9e08ecb106a80f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe

Filesize
468KB

MD5
a1753b0ba71d47a7ec94a8a4708e86ef

SHA1
a1284ca4032f337b939166d962a3eb321c387018

SHA256
c0c535c4a27e66b686cc9d9f7cb5c45fd134f8e01be682ff4cc77207020e7dd7

SHA512
33a9cf71f0f42fff2f7a2c17387a2f8608ab0aaee76a06e9e81165d583aa5363e787182f6a28daa381432d6e475818cece55805edab9c9f358ebbd59bad4ca3f

Download Submit
memory/8-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/60-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1304-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1848-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-64-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2956-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3184-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3256-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3788-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3832-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4080-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4500-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4612-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5040-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5256-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15308-2492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads