3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978e

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe
Size

468KB
MD5

ab632ef618dae1b9a1dec3e2dfee2410
SHA1

bedd375b9398e7f85902dbb4bf8585764676ace5
SHA256

3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978e
SHA512

26ad7bc7e98a31c6db74beac7950e7211e6d3cb88b3bc076ca5eb6c6bc1940b21e2665dee00cdb93ee718ef51570688adc53487cef4c705bde5a27117a04e75d
SSDEEP

3072:1qmRogWxj28U2bY2PzThqf8/lCZj4epXPmHx8/0kRDd+hAQN+nlM:1qsoxXU21PnhqfaOSoRDI2QN+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4176	Unicorn-43108.exe
4352	Unicorn-9771.exe
4796	Unicorn-22578.exe
4032	Unicorn-27172.exe
3648	Unicorn-48147.exe
1136	Unicorn-42439.exe
1004	Unicorn-37186.exe
1160	Unicorn-10132.exe
2752	Unicorn-22939.exe
1268	Unicorn-15347.exe
2072	Unicorn-35213.exe
2364	Unicorn-51549.exe
1060	Unicorn-61563.exe
4676	Unicorn-2156.exe
3932	Unicorn-35633.exe
5056	Unicorn-11019.exe
3156	Unicorn-30885.exe
2684	Unicorn-64325.exe
4684	Unicorn-7842.exe
2472	Unicorn-62981.exe
1360	Unicorn-10827.exe
2344	Unicorn-55197.exe
4896	Unicorn-41491.exe
2376	Unicorn-22554.exe
2208	Unicorn-29562.exe
4828	Unicorn-61165.exe
2876	Unicorn-11202.exe
4200	Unicorn-16795.exe
5108	Unicorn-44829.exe
1148	Unicorn-52732.exe
1528	Unicorn-31866.exe
4204	Unicorn-41195.exe
2408	Unicorn-47325.exe
5044	Unicorn-64045.exe
4044	Unicorn-44180.exe
4464	Unicorn-31373.exe
1584	Unicorn-12192.exe
4420	Unicorn-39084.exe
2576	Unicorn-8596.exe
1900	Unicorn-49629.exe
4324	Unicorn-54076.exe
3988	Unicorn-14112.exe
5004	Unicorn-26970.exe
2188	Unicorn-13235.exe
3600	Unicorn-38877.exe
1664	Unicorn-35155.exe
4000	Unicorn-38685.exe
3548	Unicorn-14564.exe
3464	Unicorn-8434.exe
5064	Unicorn-31093.exe
2104	Unicorn-55405.exe
4408	Unicorn-33130.exe
2184	Unicorn-5442.exe
3264	Unicorn-14372.exe
2264	Unicorn-2867.exe
1508	Unicorn-54445.exe
4344	Unicorn-37147.exe
2280	Unicorn-59084.exe
1536	Unicorn-62348.exe
3740	Unicorn-33781.exe
3952	Unicorn-33781.exe
1892	Unicorn-42333.exe
3164	Unicorn-25805.exe
1348	Unicorn-33013.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4332	3236	WerFault.exe	162
14904	14028	WerFault.exe	665

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44904.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10466.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37147.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16540	dwm.exe
Token: SeChangeNotifyPrivilege	16540	dwm.exe
Token: 33	16540	dwm.exe
Token: SeIncBasePriorityPrivilege	16540	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe
4176	Unicorn-43108.exe
4352	Unicorn-9771.exe
4796	Unicorn-22578.exe
4032	Unicorn-27172.exe
1136	Unicorn-42439.exe
3648	Unicorn-48147.exe
1004	Unicorn-37186.exe
1160	Unicorn-10132.exe
2752	Unicorn-22939.exe
1268	Unicorn-15347.exe
2364	Unicorn-51549.exe
2072	Unicorn-35213.exe
4676	Unicorn-2156.exe
3932	Unicorn-35633.exe
1060	Unicorn-61563.exe
5056	Unicorn-11019.exe
3156	Unicorn-30885.exe
2684	Unicorn-64325.exe
4684	Unicorn-7842.exe
2472	Unicorn-62981.exe
1360	Unicorn-10827.exe
2376	Unicorn-22554.exe
4896	Unicorn-41491.exe
2344	Unicorn-55197.exe
1148	Unicorn-52732.exe
4828	Unicorn-61165.exe
5108	Unicorn-44829.exe
4200	Unicorn-16795.exe
2876	Unicorn-11202.exe
1528	Unicorn-31866.exe
4204	Unicorn-41195.exe
2408	Unicorn-47325.exe
5044	Unicorn-64045.exe
4044	Unicorn-44180.exe
4464	Unicorn-31373.exe
1584	Unicorn-12192.exe
4420	Unicorn-39084.exe
2576	Unicorn-8596.exe
4324	Unicorn-54076.exe
5004	Unicorn-26970.exe
3988	Unicorn-14112.exe
2188	Unicorn-13235.exe
1900	Unicorn-49629.exe
3600	Unicorn-38877.exe
1664	Unicorn-35155.exe
4000	Unicorn-38685.exe
3464	Unicorn-8434.exe
3548	Unicorn-14564.exe
2184	Unicorn-5442.exe
3264	Unicorn-14372.exe
2264	Unicorn-2867.exe
4408	Unicorn-33130.exe
5064	Unicorn-31093.exe
2104	Unicorn-55405.exe
2280	Unicorn-59084.exe
1536	Unicorn-62348.exe
1508	Unicorn-54445.exe
4344	Unicorn-37147.exe
3740	Unicorn-33781.exe
3952	Unicorn-33781.exe
1892	Unicorn-42333.exe
3164	Unicorn-25805.exe
1348	Unicorn-33013.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 4176	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	82
PID 2572 wrote to memory of 4176	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	82
PID 2572 wrote to memory of 4176	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	82
PID 4176 wrote to memory of 4352	4176	Unicorn-43108.exe	83
PID 4176 wrote to memory of 4352	4176	Unicorn-43108.exe	83
PID 4176 wrote to memory of 4352	4176	Unicorn-43108.exe	83
PID 2572 wrote to memory of 4796	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	84
PID 2572 wrote to memory of 4796	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	84
PID 2572 wrote to memory of 4796	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	84
PID 4352 wrote to memory of 4032	4352	Unicorn-9771.exe	85
PID 4352 wrote to memory of 4032	4352	Unicorn-9771.exe	85
PID 4352 wrote to memory of 4032	4352	Unicorn-9771.exe	85
PID 4176 wrote to memory of 3648	4176	Unicorn-43108.exe	86
PID 4176 wrote to memory of 3648	4176	Unicorn-43108.exe	86
PID 4176 wrote to memory of 3648	4176	Unicorn-43108.exe	86
PID 4796 wrote to memory of 1136	4796	Unicorn-22578.exe	87
PID 4796 wrote to memory of 1136	4796	Unicorn-22578.exe	87
PID 4796 wrote to memory of 1136	4796	Unicorn-22578.exe	87
PID 2572 wrote to memory of 1004	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	88
PID 2572 wrote to memory of 1004	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	88
PID 2572 wrote to memory of 1004	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	88
PID 4032 wrote to memory of 1160	4032	Unicorn-27172.exe	89
PID 4032 wrote to memory of 1160	4032	Unicorn-27172.exe	89
PID 4032 wrote to memory of 1160	4032	Unicorn-27172.exe	89
PID 4352 wrote to memory of 2752	4352	Unicorn-9771.exe	90
PID 4352 wrote to memory of 2752	4352	Unicorn-9771.exe	90
PID 4352 wrote to memory of 2752	4352	Unicorn-9771.exe	90
PID 4796 wrote to memory of 1268	4796	Unicorn-22578.exe	91
PID 4796 wrote to memory of 1268	4796	Unicorn-22578.exe	91
PID 4796 wrote to memory of 1268	4796	Unicorn-22578.exe	91
PID 1136 wrote to memory of 2072	1136	Unicorn-42439.exe	92
PID 1136 wrote to memory of 2072	1136	Unicorn-42439.exe	92
PID 1136 wrote to memory of 2072	1136	Unicorn-42439.exe	92
PID 3648 wrote to memory of 2364	3648	Unicorn-48147.exe	93
PID 3648 wrote to memory of 2364	3648	Unicorn-48147.exe	93
PID 3648 wrote to memory of 2364	3648	Unicorn-48147.exe	93
PID 4176 wrote to memory of 1060	4176	Unicorn-43108.exe	94
PID 4176 wrote to memory of 1060	4176	Unicorn-43108.exe	94
PID 4176 wrote to memory of 1060	4176	Unicorn-43108.exe	94
PID 1004 wrote to memory of 4676	1004	Unicorn-37186.exe	95
PID 1004 wrote to memory of 4676	1004	Unicorn-37186.exe	95
PID 1004 wrote to memory of 4676	1004	Unicorn-37186.exe	95
PID 2572 wrote to memory of 3932	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	96
PID 2572 wrote to memory of 3932	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	96
PID 2572 wrote to memory of 3932	2572	3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe	96
PID 4032 wrote to memory of 5056	4032	Unicorn-27172.exe	97
PID 4032 wrote to memory of 5056	4032	Unicorn-27172.exe	97
PID 4032 wrote to memory of 5056	4032	Unicorn-27172.exe	97
PID 1160 wrote to memory of 3156	1160	Unicorn-10132.exe	98
PID 1160 wrote to memory of 3156	1160	Unicorn-10132.exe	98
PID 1160 wrote to memory of 3156	1160	Unicorn-10132.exe	98
PID 2752 wrote to memory of 2684	2752	Unicorn-22939.exe	99
PID 2752 wrote to memory of 2684	2752	Unicorn-22939.exe	99
PID 2752 wrote to memory of 2684	2752	Unicorn-22939.exe	99
PID 4352 wrote to memory of 4684	4352	Unicorn-9771.exe	100
PID 4352 wrote to memory of 4684	4352	Unicorn-9771.exe	100
PID 4352 wrote to memory of 4684	4352	Unicorn-9771.exe	100
PID 2072 wrote to memory of 2472	2072	Unicorn-35213.exe	101
PID 2072 wrote to memory of 2472	2072	Unicorn-35213.exe	101
PID 2072 wrote to memory of 2472	2072	Unicorn-35213.exe	101
PID 1136 wrote to memory of 1360	1136	Unicorn-42439.exe	102
PID 1136 wrote to memory of 1360	1136	Unicorn-42439.exe	102
PID 1136 wrote to memory of 1360	1136	Unicorn-42439.exe	102
PID 2364 wrote to memory of 2344	2364	Unicorn-51549.exe	103

C:\Users\Admin\AppData\Local\Temp\3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe
"C:\Users\Admin\AppData\Local\Temp\3e7836eacf3952e008cf22e88b56efca9c120a32ca90ab7739523eff70da978eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47325.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29202.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        9⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15481.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        10⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27899.exe
        9⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        9⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58539.exe
        8⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23351.exe
        8⤵
        
        PID:17404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        7⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        9⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        9⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51431.exe
        9⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        9⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        9⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28050.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        9⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        8⤵
        
        PID:18172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        7⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46869.exe
        9⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45549.exe
        10⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        10⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        9⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        9⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19323.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        9⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6521.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        9⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        9⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59599.exe
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15382.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        6⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28213.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        9⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        9⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40960.exe
        8⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25864.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11523.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32587.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59035.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        7⤵
        
        PID:424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52376.exe
        6⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5113.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        7⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58965.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        9⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        11⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        11⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        10⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        9⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        9⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        9⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        9⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        8⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28525.exe
        9⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        9⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        9⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10346.exe
        9⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41121.exe
        9⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        8⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25186.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        6⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18229.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        9⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        8⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16171.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16706.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27461.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42967.exe
        7⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34851.exe
        7⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51228.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19002.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12586.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26129.exe
        9⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        8⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2411.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16058.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48256.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41828.exe
        7⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63495.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23226.exe
        8⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        7⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60168.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59616.exe
        7⤵
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56799.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48892.exe
        5⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64604.exe
        7⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9258.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47713.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44503.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12579.exe
        5⤵
        
        PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19882.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        9⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16087.exe
        9⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24430.exe
        8⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61041.exe
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17971.exe
        7⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28213.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63317.exe
        9⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        9⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54604.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61031.exe
        8⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        7⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4039.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        7⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        8⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51745.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63455.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12192.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8996.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27957.exe
        9⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        9⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18846.exe
        9⤵
        
        PID:16064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        8⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        8⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33852.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25771.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
        8⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        7⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43043.exe
        6⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        7⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:17688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33162.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
        6⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        5⤵
        
        PID:2452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        7⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38067.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20532.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
        5⤵
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4314.exe
        6⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42699.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4622.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58929.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11339.exe
        6⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
        5⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        8⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58231.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22011.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        7⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26761.exe
        6⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32658.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41181.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        6⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35259.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5215.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-862.exe
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
      4⤵
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24810.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17695.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46433.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        6⤵
        
        PID:17984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20147.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24965.exe
        5⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        5⤵
        
        PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50794.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2178.exe
      4⤵
      PID:13396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48231.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38877.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
        8⤵
        
        PID:1356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47941.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        9⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25653.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41931.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        8⤵
        
        PID:17280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40659.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7031.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        7⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
        6⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        8⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45077.exe
        9⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54241.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28297.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        7⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        7⤵
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        7⤵
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35155.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36909.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        7⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38475.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4626.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        6⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60899.exe
        5⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        8⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        8⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16543.exe
        7⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30296.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60715.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        6⤵
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20747.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        5⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54577.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42717.exe
        6⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28933.exe
        9⤵
        
        PID:13704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        9⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20307.exe
        8⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41440.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17589.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29527.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3970.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58234.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48760.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:17680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64003.exe
        6⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33261.exe
        7⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14028 -s 464
        8⤵
        Program crash
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21447.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        6⤵
        
        PID:13688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        6⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50268.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62216.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        6⤵
        
        PID:18272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32946.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        6⤵
        
        PID:18456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43193.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        8⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44904.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        7⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14727.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3662.exe
        6⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41232.exe
        5⤵
        
        PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
      4⤵
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13346.exe
      4⤵
      PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        5⤵
        
        PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
      4⤵
      PID:4208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
        6⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        8⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        7⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60890.exe
        7⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36411.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62821.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61082.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64708.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7978.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21359.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        5⤵
        
        PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        5⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        7⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        6⤵
        
        PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16663.exe
        6⤵
        
        PID:17748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24624.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11335.exe
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        5⤵
        
        PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63153.exe
      4⤵
      PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23930.exe
      4⤵
      PID:12180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11255.exe
      4⤵
      PID:3532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55405.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24949.exe
        5⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13812.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56109.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28985.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        6⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        5⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        6⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        5⤵
        
        PID:17620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6905.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37957.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        6⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
      4⤵
      PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        
        PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2.exe
      4⤵
      PID:11708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      4⤵
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5442.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
      4⤵
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        6⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18179.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        5⤵
        
        PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12203.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59285.exe
        5⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41551.exe
        6⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27014.exe
        5⤵
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49595.exe
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47488.exe
      4⤵
      PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
    3⤵
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23133.exe
      4⤵
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        5⤵
        
        PID:16260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        5⤵
        
        PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
      4⤵
      PID:18352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43041.exe
      4⤵
      PID:16732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9090.exe
    3⤵
    PID:10412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34319.exe
    3⤵
    PID:18316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        9⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        9⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43351.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        9⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        9⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-219.exe
        8⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39887.exe
        8⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25171.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        8⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63260.exe
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59109.exe
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13279.exe
        8⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
        7⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        9⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        9⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1562.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        7⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        7⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37730.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55519.exe
        6⤵
        
        PID:18308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54668.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17485.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        8⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        7⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
        6⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26909.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62495.exe
        7⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
        5⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63205.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        8⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        7⤵
        
        PID:1032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        7⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34992.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11124.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61060.exe
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30398.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49733.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42925.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12580.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3191.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
        8⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65247.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31133.exe
        8⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        7⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57460.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45300.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9835.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21507.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        7⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15895.exe
        8⤵
        
        PID:17768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10014.exe
        7⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29707.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8375.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39099.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58459.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11927.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3467.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        5⤵
        
        PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26970.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49157.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18939.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39703.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48552.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        6⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        7⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11463.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        6⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        7⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        5⤵
        
        PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
      4⤵
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36381.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19981.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
        6⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59011.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45619.exe
      4⤵
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60572.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
      4⤵
      PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6436.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58389.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
      4⤵
      PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
      4⤵
      Executes dropped EXE
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38331.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31109.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36701.exe
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59041.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-962.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47749.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        6⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        6⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65048.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10546.exe
      4⤵
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38068.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36264.exe
        6⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        5⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46229.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19434.exe
        5⤵
        
        PID:13064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15879.exe
        5⤵
        
        PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2510.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
      4⤵
      PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
      4⤵
      PID:19276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40147.exe
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16046.exe
        5⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56931.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
      4⤵
      PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9508.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
        5⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37295.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2287.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21906.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63320.exe
      4⤵
      PID:3784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62348.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15757.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6174.exe
        6⤵
        
        PID:18320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        5⤵
        
        PID:1008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52680.exe
      4⤵
      PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16617.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        5⤵
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48719.exe
      4⤵
      PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1674.exe
      4⤵
      PID:6704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23418.exe
    3⤵
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34013.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        5⤵
        
        PID:18100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
      4⤵
      PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
    3⤵
    PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54957.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      4⤵
      PID:13988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-532.exe
    3⤵
    PID:11720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
    3⤵
    PID:5476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16677.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34181.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        7⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        6⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55464.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46144.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35243.exe
      4⤵
      PID:3236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 640
        5⤵
        Program crash
        
        PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44772.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10487.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58090.exe
        5⤵
        
        PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10466.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42003.exe
      4⤵
      PID:13736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
      4⤵
      PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15629.exe
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38317.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        7⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44028.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        6⤵
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20273.exe
        6⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40591.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        5⤵
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4315.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14196.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21434.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11163.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
        5⤵
        
        PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58632.exe
      4⤵
      PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23162.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30744.exe
        5⤵
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      4⤵
      PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      4⤵
      PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57538.exe
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21493.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1337.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18386.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
        6⤵
        
        PID:18264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39328.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22127.exe
        5⤵
        
        PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
      4⤵
      PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23916.exe
    3⤵
    PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21429.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11881.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50380.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
      4⤵
      PID:17580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14690.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14690.exe
    3⤵
    PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39685.exe
      4⤵
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
      4⤵
      PID:3444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
    3⤵
    PID:18080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41019.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19293.exe
        6⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42093.exe
        7⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49720.exe
        7⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61152.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
        5⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28357.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63632.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14569.exe
        6⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31844.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6796.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14254.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        5⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-664.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
      4⤵
      PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
      4⤵
      PID:12912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15436.exe
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        6⤵
        
        PID:17652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8950.exe
        5⤵
        
        PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39585.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
      4⤵
      PID:1864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33838.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
    3⤵
    PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40261.exe
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
    3⤵
    PID:13172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
    3⤵
    PID:11336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54445.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58347.exe
      4⤵
      PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
      4⤵
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46971.exe
    3⤵
    PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6028.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
        5⤵
        
        PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59596.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33262.exe
      4⤵
      PID:2616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64497.exe
    3⤵
    PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31029.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3383.exe
      4⤵
      PID:1504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
    3⤵
    PID:11452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
    3⤵
    PID:5804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37147.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11892.exe
      4⤵
      PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15315.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17118.exe
      4⤵
      PID:14792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29307.exe
    3⤵
    PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31605.exe
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
      4⤵
      PID:14572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25684.exe
    3⤵
    PID:13276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
    3⤵
    PID:5604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
  2⤵
  PID:4668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44565.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12004.exe
      4⤵
      PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3852.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50676.exe
      4⤵
      PID:14312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25579.exe
    3⤵
    PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      4⤵
      PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32423.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42007.exe
    3⤵
    PID:1788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
  2⤵
  PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22861.exe
    3⤵
    PID:8552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
    3⤵
    PID:14376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47864.exe
  2⤵
  PID:11552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
  2⤵
  PID:16248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3236 -ip 3236
1⤵
PID:5412

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe

Filesize
468KB

MD5
b80b467c8dfb68aa5a0c943803462878

SHA1
8ada460c62c8d319ce4f0ea32cef17b68a618e0a

SHA256
ddeaea42b6333fe5db9e6af5474fffbb40df34f01007408a32ade0ee3979edff

SHA512
12abfe98371483945cadcf72caa27b7264a4300a661d09bd12a81d66820a501a09cf59bfb9f91f9a61a05c728b6bd6df07a09ba04924089586e03d5cfa4121da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe

Filesize
468KB

MD5
cdc5a6681c51360c1c34aebf81b00cb2

SHA1
583a04441bb2c81e3ae26fa66c4fc3805df84dfc

SHA256
197532ae6ce71c4ed88ee6ed45174cb974b23a38c797f22952093330a9c15d8c

SHA512
d8a395a088b065ce07e24dd71c244d805449ecdae6287e354bc3f87bdcd8301d2bb7c428bc164b98dd9f6dd125868f9d0043889925ac5a2c9d8f16d14650aff2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe

Filesize
468KB

MD5
e5ef5ac4e6475c07ab521ac29698e536

SHA1
9bbc680c2cfd9e58b44df37674dfa2b4bf718d9d

SHA256
9003f1d5e4b2cbb3a6d0f7926958be52f62d5b5cc2f835084394f6fb0c0a608c

SHA512
00d7f60eb81a4ca0ba9a3fdd58a66d17ef6bd17946cbef52030702e21726e2bf3a765b69381157f476dd40fd451cd004f433eb50bae25320a39f159270ded6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe

Filesize
468KB

MD5
1c44cee04f18188b77ca6ef2388486e2

SHA1
4ac9707da4b5e175093a35ce0fb7a95c0dd3efb4

SHA256
d70a8a5769d031c5b594c0809c7ca8511b33f78af9d691c5ea34226718ec1733

SHA512
63ff36db6c752ed43eb25161cc1eed8327b47e484e0420c5687ba2d1b1f7e5235a45e555ddbfb196fe014b29b45bf052322e795fa1175fa589996401a8bcd9ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe

Filesize
468KB

MD5
f600d8871c87d210add8d89fa1c91c27

SHA1
3e4da4091c70fdaf90d63527dcc6bccc98a69117

SHA256
2c16a02dfd61d761993db379a1547618ffb7bd41555145b9c86d27f13b2f94cf

SHA512
7d442504f976049608481071ed58c10e1a6a98b6a8ea5d711eec1c5c641c2079a24b49a0e9f90f1738561818dac2bb17f79dddad59ae02b4f9eb1b731653fb9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15347.exe

Filesize
468KB

MD5
11df1f6c78bad01937ec69d3545efa1b

SHA1
3de9eb6aebbb7b23d57cee49b93934418649ea85

SHA256
0fdefe015bf74aa9d4c59a9c65104236f8ff436c2f39603a211e2625d807c2ce

SHA512
4dd051601a82eab53d1cc013a805f8a148111d096aed77da00cac9e0008cf8648247fdea0ddab3ee1a6ad319ae74fea4b9017a52fed97ab45fe911df98a58081

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe

Filesize
468KB

MD5
461e19423420c996c65c1ee4b62f8221

SHA1
3877e9a928563c428a9f179df929dfa79f6edc0c

SHA256
6dc0c82ae8fbe1e8fbf270d89cb4ab42e8a455afac40d0a6df28f7144ca588cc

SHA512
8494b00c00ea064de00c1be9119cf8c0af08be893ef674f426f1c7a7543e5bbbb9677379d77741cc9379a1dc232fb58f20c4b8fbdfb10640489eea587cb64550

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2156.exe

Filesize
468KB

MD5
436067faef7b49fa343381938c601dfd

SHA1
0b473482c83beb38756cf916e114fa1e0e3360d1

SHA256
9b4e6e75bbce45a4da13b24ff26f8a62953e0ea79809892fb8a71108faf00062

SHA512
752f7dbb1b7bb116686a4c42baa31ab2ba8f93e2b5fc4ca6f5dc1040825478fa684634990b7f008d14bf8dd60578a7cd2f6844c8b4483a62b24653628d581942

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe

Filesize
468KB

MD5
e4592666d684844abdb76ab63b50c40c

SHA1
e8ab1c009500bcfc686b8ba19bffc0673401b402

SHA256
5cc296166bf4c7777cd32f93dabd4548aa80c27631242bd77cfde355570030e9

SHA512
a019ea845aaea3b199724042abea4b674c4bc33c47d0f20ea7f4b2c0cb41122227b2a4d615f919975469ab816dca72110432045a7a4819fe1b42d12a769e4bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22578.exe

Filesize
468KB

MD5
19a38eb70281b76540300c4cacc84fb1

SHA1
ddbafabc1ea0fc8b67c3eb95fa0a19b0e830232b

SHA256
e65cd32ccf58f15aff4d28b28930a84fb46850ff74edc673605bf0ca9a3f0b6c

SHA512
ded3ff48f589f58be85ff59c7e743fac164a17b95b5d143c3b8845c1d85f27d2312c7b07ccfa75515067b8e9d4a1caa96fb933a16a2059825538cfa9a42351b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe

Filesize
468KB

MD5
146a4650d39e5797b3a62efe14eb5246

SHA1
a8c83c63025dfae291f3b2c8c592afadc196357f

SHA256
dcae502a1f7bce07e12a031ce8264fedad3838fbb7fa0d119d6cbd9c1f61c5b2

SHA512
f4e6b1e28d88055917f8f264431580d35bc23a069833ff9d52efbd1e30e4bf7e93a48b404eb870b90cef43c6e91af414ecc21b834713d680abb767f99f562802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27172.exe

Filesize
468KB

MD5
afc18cc49bb78cf1557b6c964d4842a1

SHA1
1cffe0335f4ca29fee6d521afefc3099ca53b2a2

SHA256
36a01ec71daaeef85c490f529ed08f4c773f03ffacd984020028bc8b84a0b23a

SHA512
bd767ad430aa17c8ae82bb1bfe3c197f58467044327c13da495458c878a79a8c39323fdade6ad8c774079da639471e37359c0b0f6e2a44eeda58192cb83eea73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe

Filesize
468KB

MD5
81e6875a1b4de8359f311ca7999eaae2

SHA1
1e335a34485d11825ac6cff3b15ab1226cd57f1a

SHA256
d871f00da32157860a26a821032bf88c37f2d3fc4741d137c97bc6dc97f860ed

SHA512
838b7371ff19ff9dc35d6641c4567624fe59375808dd1d28a509413f2b3b8dacec5f0a1794ea28e5f2f50c6553c8b602e2ac0afa5cda5ffbdd342304948a6711

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30885.exe

Filesize
468KB

MD5
894a9571635bc33267fed7211af3a54e

SHA1
c4420e113f80da9597c34d08d3f9cd897f73f53c

SHA256
e02e739d218da03189fb1f5b6e238c590f3554b77b60ccbf3601bc12590a254d

SHA512
c0238112a383f623a0370da53e2ad4b31c9a2bfdb24779bfcc0eba649c39a53a0eca625489b4f61dc06ba1370c13cc5d0115c1f74a6dbd3092ed897c1aef8d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31866.exe

Filesize
468KB

MD5
39b8f463125066b9e80695e09a4a9770

SHA1
5f9f1c2cc38709bbff6e8e401464c93990530d89

SHA256
2378f53a0e71ca7395470b15047da5a0d3f5e1a83c57b9462f81ab94feeed26d

SHA512
3fa486ba1fb42d8c6f3bc572d023c6bd5e8fa21c2d76dcfa1384de2d7701cd61e033e6b4eca071920ec11622746fa413937f438e9cfbd25644f3e67209bf608b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35213.exe

Filesize
468KB

MD5
e33df376eb388a7c0f6eb86aa1bfef02

SHA1
9cd1520f76adee05458f42b114bd8440510e0ea3

SHA256
e555e077e902d5f9f3566890d75fd2262a57026c5b764f7b3e61ad6300fb001c

SHA512
89802fd1fec0ec30ca0fae84dec4d5ad88905b45c21e374885497c28120f6900cb1853e1b1d27228065c4a1850637ef9b7d876806c8bc01ee946e661520fd3f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe

Filesize
468KB

MD5
74c6f65b96fded5923359a64e130209f

SHA1
46e5b4e326ddc6704896b1ae1efd1f54dd9c8ed0

SHA256
436c8d960a1f0178c35b81dcac0f0111fa396540d67821bf70146f9534fe9554

SHA512
293685fb3c8a9cce7f1abce89f71b1aa897c616361df2f372e87fdf905eafdba3abad4e0ae8d05d105ac8a6940d9a2218af4f2a077de0d572b6c1a96c6f9ee53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe

Filesize
468KB

MD5
4bad8d4aba7c28abf94fc097e0af15a2

SHA1
3a3ee253804619e28fc1e33d41724154bb9903f7

SHA256
36a515888c7ad77a1a0c82589b847b0a2ef173b5a81d3663b04d38ce25445d24

SHA512
54674fc41e17a9150febc68b6a985cc64ae7dd16a5dd9b9712fae8787d864533cf8dfe76fb9bdaf117eef9561f44c58890d1100f6115e514d5b18d1afbce8fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe

Filesize
468KB

MD5
6fd9919096aac6b5eee6a871171acae5

SHA1
3cb1ec615e48321fe4e0914e04a3eef56cda0665

SHA256
3f4d3bd4478ddb87a615c33e05c85f162573cf15631a1f6460a92c216e4b70c2

SHA512
29a51b33342ec8337728f7626aab0396e7e6da413806cea39833f86783a1c53e2e530dc59943ad57c7ba59404427d7530a07b8f16c203c17ecb7e28936a547fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe

Filesize
468KB

MD5
e68e1fdd782701f6ba63b47b4daa8770

SHA1
1f075f05900a174785e9d2515b39a162c965d1ea

SHA256
67c3e10a33556b70651509b3ac0181caf5aa96acaba426ecdf46d6d82df332d0

SHA512
35f9898bef94cadbc689d96ab2e540bc2cb20ba10955163790d7958b2742963036eab2f091eb6debfa0c2cca87314b9d15202f632c11f1d56a5cf5949ac66dd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41491.exe

Filesize
468KB

MD5
0aab6030b019a309e4e8ca66c77e6d23

SHA1
468f7f0b34b58a0e2d3d92da3c00565d4f4c40e2

SHA256
d6c36a71b4e39bf9c6eba1c107b1637089a61309478190cc8ee7f4cd928eddaa

SHA512
96104090fb2207149fd0a3cc5823c48e2f71b3f8ceacf886b180cab83efbe2edb4f0480d4734a557e047f83117116e571f534872d5a73fafe94452ecf12e9535

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42439.exe

Filesize
468KB

MD5
0da4fb2fccd7a7f36854d17324e58714

SHA1
884b84ef069ee50506599a026c304985483c1376

SHA256
27c2b163e123bc9454436fada47e663d66d852ac75a74119a0bd094c3e7fd1a4

SHA512
4f97ab8aae52dd1a00e585fbe7c84a50490895c6f4e54ae1afa494771cff9614ae1e12c474c0b98d9d8864bd1c8d0d20c9d7e70f408123652986d959ee482b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe

Filesize
468KB

MD5
20d934025f0e976a43ad17928ed87b87

SHA1
a96db9ce02bca7032d2d35d05a66998883de8424

SHA256
56bd8434e9e48fa545ab9ec3b8627ced38592a4afd0fb3b0c128892ba2174035

SHA512
7d184ba9c01d487162faba6eb9ab7b6d02426191529ddd05e707cf9a5ceae9bd397576a7b942ee6802914a756a9b5065bc3997e1e07e25fc647cb571012f5f50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe

Filesize
468KB

MD5
d3098f38cc2aaf223c9bd8da54962d05

SHA1
367494443880e64e8522108fe87a09494edb4d5e

SHA256
c9e8c955d815698c8b645bae62088ff2120f3d213c750b91f87b6ad3b9877fae

SHA512
37a277980a30e2cef7a7f62428042e85194ae7a484677f69656703304127df5dc0043a6a707c7561d0b061957e3e631a91309430eb22f6fe646bd87c21bd246e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48147.exe

Filesize
468KB

MD5
a55c4879a262ed02cbe3402e44bca384

SHA1
c776057ccfda8e970166d533d08d08a779b2215f

SHA256
4a5da59463a3d26915c30804fcdbeaa0b8c2f64984f80760674ffb611d94befc

SHA512
5a39546d7050e342f8ebf076362a37526c71198f0479f0916640fd49fcbc1c6c31899d7543032634cf6e5a0fae1c876c555322d2a57c6583c3cd10d494f96e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe

Filesize
468KB

MD5
d186c1bf112f22d5b8b11dd69cd1eab7

SHA1
92b14012a9409b398a782e9007666d1a89530715

SHA256
ebd1e726efdf139d7f71fdf3f08ea833093c7bd0a280477b91d9b3fb470617f5

SHA512
ff476db4b4e80bb0a6dc5c02865232030cbf3b2126e3cf8bec7c6b9b6a222b3f9d46d6b70e0e3ce562d9bcc0e55041fc450218d454051a25097ca86e12ab3dc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52732.exe

Filesize
468KB

MD5
ddf471cc3d84018c7906ee169537135d

SHA1
b005e2ecc13e3fd2966061a4ecc6729b737b3591

SHA256
3c26474a97e886baecc46e9390e26577cb933d14e42d7736b8dafb7dd81e3965

SHA512
ae6a6a2db62c3fc0dde7f33d34e71302ad0d78458d9494ebc8480ce15e3711930caf1eb8e559565215acc68c6ad79d178b0fa70383723e724e2d5f7e91b70477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54755.exe

Filesize
468KB

MD5
51a8412db64f611781628571b4644f85

SHA1
065b13a0a0aded095bff97f9004475203bc8dbc0

SHA256
66eb18b68e94369822e0dba73e2a8b48620670dc8d04a100e506dee3cad4530a

SHA512
9488299c9fbd74c482fa0aa07c85ea70553e9eff6313bee8e3869c919796274b1d7e02c6f70c6de628f4ccd2ce7e08ebb1d99adf23231a98edef4e77e677306c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55197.exe

Filesize
468KB

MD5
1706504dd610ee79ac14cbf28f18c940

SHA1
52a2e83c3ecc656ee6f719370ea1f6a2bb56d4dd

SHA256
6d26f64eabed915412a0149e748b23619db66825e240c2971eba8413344dc0b4

SHA512
0a526a6788fc6d414b127f16b09ed133de1a47ff5de51bbf15013befd16c7234307d6710f54144a428b7c377d97ae3027dc4f4ed810eb772ade3c7c5973d836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe

Filesize
468KB

MD5
908fc6788323dfa3971ed0f83c563836

SHA1
3a77f3eb333358f03b2bae2610723422b23b1a45

SHA256
578f343e681e99c5fe159a2fc57b53a091aa9c92982bf5a5b7f658c5fe482284

SHA512
9cc0e2cb796d59dbc2f2f63158bedcaf7964bc4a02adc88031c5e003872c5eb7a9984f9d2e4cd4a12f68c0a23279b6f6d4242acec61a20136eee3a18ecad300f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe

Filesize
468KB

MD5
b32d28401a0b84d0350fed68db1082b8

SHA1
e29a64d69e3e10da68bac088a226a696787b187c

SHA256
a7f7ab789f2d521f749cbac406614544f6f7acb17d64eb31e77e1e3d3244c52b

SHA512
a7046ee861823fa59ed2cb2f2e662cb8d39e97954456828c8811b2532d7482259520a7b9b6f486d008d2375fdf717c1a380e91e2a0407f16a07daf84def6eb50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61563.exe

Filesize
468KB

MD5
30acfe63694ddabd21b9a7514f11e5a4

SHA1
0ea7ed8da4002dca0d0b2b3c27541eefffff616a

SHA256
abb30a035eeca61840bd5a6d333524971a3e54f2bbd37e7c0110f70b481b6f6f

SHA512
733b31fb44d8a98ffac377050eefeaab170eddcbe5424d5dd224fbc2f51d277b3b5c85aef1d5316680a3bb27a560e025008a9a5b25cbcf2bccccbef51e5e410b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62981.exe

Filesize
468KB

MD5
5987e1c4b876df7c1c745eb234db3b52

SHA1
69726abd91ce1ef32a03cb925d548b7e0a881009

SHA256
5815234e5bd2d4fa585eae84dd44a637587f163bbec16027626478927e2e684e

SHA512
1308ef58d73e199ed2c61f67fa500c2c300c00a34704c7f6d4d529537af75a3d0bcf12bcfd6b1b27dca02b64cbff0cc7f13c80508afceaa11406927a9d2aebfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64325.exe

Filesize
468KB

MD5
ba024bb96dbed946824245fc2b9c0c2c

SHA1
d84f59e1d5d2ee38f624aef18483bd1186ab1e56

SHA256
058be5ab13957ce7bfd8b175bb8be4e023799cfa7854b1b741e0a722dff6ada3

SHA512
782ac54d6187b79d65f1d9d6c3c4edea1a022a09d6574c335a76895eb2659b248b2d1215d2fb9023354905131d44b96a410c434cda8d6d82fccd021b1f8f0bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7842.exe

Filesize
468KB

MD5
5ff42588048a0b040ce2e4ed6aa84c98

SHA1
ebf5297b91ecd6a4489e5ff9c93180883cd0d1d4

SHA256
ba72d5654a892759f3e1bd4ed6cc06cc3d21d73af47d87b84db29865994a869b

SHA512
7abd1422cc7515482e9646bf4b993e40c8e3f3e68212e7e0ab35a0622575c79f5c77779b2cb1ecdab8e6981955b28fb8274148e054e7c8422e10c319776b9fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9771.exe

Filesize
468KB

MD5
4a8f7b008b3969043f9aea22de605948

SHA1
c35c56252451494e2d6f371e697cd188477a4621

SHA256
33a123f4c0100dff4c36665fddbc5dd135f3e39debc37db252b5266a0ac11dc4

SHA512
e10c9ba504b90dc58c1920cb0c282220ad6011bdfd62abb15901d61f9f5db57a543094039be834700d02d62739b2e39bbf43422318ed0d2ef24c81b3dd53c02f

Download Submit
memory/404-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1360-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2020-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2028-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2072-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2376-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2408-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2424-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2472-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2752-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3156-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-554-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3780-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3988-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4176-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4408-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4576-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4896-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6476-3257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13428-2409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads