f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe
Size

468KB
MD5

a451c68fa7df89fd0a6440e4f26d7e90
SHA1

a62bfb98a3a877ceda07ce1918d1e82b5886f778
SHA256

f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33
SHA512

ee3f0610b603ad7baf424ffcc10d825f15088963f1001fff6fad271b62f465d4beffd0406d192a8c0af517c985f5ca7065a114a061e1d7ea74b7e35b1e75e8a1
SSDEEP

3072:VPGjovItIA5vtbYpJgQ5OfDVrrCwkqUpXlmHeVSwEv8UvfIU9SDKx:VP+opwvt2JZ5OfJ4Xmv8qQU9S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4956	Unicorn-13019.exe
4532	Unicorn-12547.exe
1052	Unicorn-50051.exe
3180	Unicorn-1011.exe
4472	Unicorn-9371.exe
5048	Unicorn-55043.exe
2552	Unicorn-10340.exe
3936	Unicorn-60596.exe
3740	Unicorn-5457.exe
3868	Unicorn-27431.exe
4876	Unicorn-27431.exe
3904	Unicorn-36668.exe
4960	Unicorn-15733.exe
4620	Unicorn-35334.exe
208	Unicorn-57835.exe
2836	Unicorn-18407.exe
4484	Unicorn-32282.exe
3596	Unicorn-61084.exe
2648	Unicorn-18525.exe
1280	Unicorn-11691.exe
3996	Unicorn-20903.exe
3664	Unicorn-9205.exe
824	Unicorn-29071.exe
4760	Unicorn-5635.exe
728	Unicorn-4566.exe
3008	Unicorn-845.exe
2124	Unicorn-14580.exe
2116	Unicorn-54452.exe
2100	Unicorn-45522.exe
3332	Unicorn-51115.exe
2140	Unicorn-53212.exe
2264	Unicorn-46964.exe
1792	Unicorn-35458.exe
3144	Unicorn-12765.exe
4192	Unicorn-63876.exe
2980	Unicorn-57746.exe
5000	Unicorn-55708.exe
3412	Unicorn-55708.exe
3164	Unicorn-26330.exe
3976	Unicorn-21500.exe
3880	Unicorn-37649.exe
4896	Unicorn-35074.exe
2400	Unicorn-54940.exe
3644	Unicorn-62039.exe
4404	Unicorn-56786.exe
3044	Unicorn-64763.exe
2688	Unicorn-45163.exe
5112	Unicorn-65028.exe
3184	Unicorn-14566.exe
3480	Unicorn-64836.exe
4824	Unicorn-64836.exe
4264	Unicorn-56668.exe
2360	Unicorn-55214.exe
2532	Unicorn-60814.exe
4604	Unicorn-18249.exe
4364	Unicorn-42754.exe
876	Unicorn-29018.exe
3416	Unicorn-52701.exe
4992	Unicorn-29458.exe
1148	Unicorn-9592.exe
2392	Unicorn-17568.exe
4328	Unicorn-37434.exe
4912	Unicorn-37434.exe
4984	Unicorn-30343.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2892	824	WerFault.exe	113
12048	7668	WerFault.exe	307
2356	14292	WerFault.exe	677

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57835.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19578.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2920	dwm.exe
Token: SeChangeNotifyPrivilege	2920	dwm.exe
Token: 33	2920	dwm.exe
Token: SeIncBasePriorityPrivilege	2920	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe
4956	Unicorn-13019.exe
4532	Unicorn-12547.exe
1052	Unicorn-50051.exe
5048	Unicorn-55043.exe
4472	Unicorn-9371.exe
3180	Unicorn-1011.exe
2552	Unicorn-10340.exe
3936	Unicorn-60596.exe
3740	Unicorn-5457.exe
208	Unicorn-57835.exe
4960	Unicorn-15733.exe
4876	Unicorn-27431.exe
3868	Unicorn-27431.exe
3904	Unicorn-36668.exe
4620	Unicorn-35334.exe
2836	Unicorn-18407.exe
4484	Unicorn-32282.exe
3596	Unicorn-61084.exe
2648	Unicorn-18525.exe
1280	Unicorn-11691.exe
3332	Unicorn-51115.exe
728	Unicorn-4566.exe
2124	Unicorn-14580.exe
4760	Unicorn-5635.exe
3996	Unicorn-20903.exe
824	Unicorn-29071.exe
3008	Unicorn-845.exe
2100	Unicorn-45522.exe
2116	Unicorn-54452.exe
3664	Unicorn-9205.exe
2140	Unicorn-53212.exe
2264	Unicorn-46964.exe
1792	Unicorn-35458.exe
3144	Unicorn-12765.exe
4192	Unicorn-63876.exe
3412	Unicorn-55708.exe
5000	Unicorn-55708.exe
2980	Unicorn-57746.exe
3164	Unicorn-26330.exe
3976	Unicorn-21500.exe
3880	Unicorn-37649.exe
2400	Unicorn-54940.exe
4896	Unicorn-35074.exe
4404	Unicorn-56786.exe
3644	Unicorn-62039.exe
2688	Unicorn-45163.exe
2360	Unicorn-55214.exe
4364	Unicorn-42754.exe
3184	Unicorn-14566.exe
3044	Unicorn-64763.exe
2532	Unicorn-60814.exe
3480	Unicorn-64836.exe
4604	Unicorn-18249.exe
4824	Unicorn-64836.exe
876	Unicorn-29018.exe
5112	Unicorn-65028.exe
4264	Unicorn-56668.exe
3416	Unicorn-52701.exe
1148	Unicorn-9592.exe
4992	Unicorn-29458.exe
2392	Unicorn-17568.exe
4328	Unicorn-37434.exe
4984	Unicorn-30343.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 4956	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	84
PID 1176 wrote to memory of 4956	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	84
PID 1176 wrote to memory of 4956	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	84
PID 4956 wrote to memory of 4532	4956	Unicorn-13019.exe	85
PID 4956 wrote to memory of 4532	4956	Unicorn-13019.exe	85
PID 4956 wrote to memory of 4532	4956	Unicorn-13019.exe	85
PID 1176 wrote to memory of 1052	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	86
PID 1176 wrote to memory of 1052	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	86
PID 1176 wrote to memory of 1052	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	86
PID 4532 wrote to memory of 3180	4532	Unicorn-12547.exe	91
PID 4532 wrote to memory of 3180	4532	Unicorn-12547.exe	91
PID 4532 wrote to memory of 3180	4532	Unicorn-12547.exe	91
PID 1052 wrote to memory of 4472	1052	Unicorn-50051.exe	92
PID 1052 wrote to memory of 4472	1052	Unicorn-50051.exe	92
PID 1052 wrote to memory of 4472	1052	Unicorn-50051.exe	92
PID 4956 wrote to memory of 5048	4956	Unicorn-13019.exe	93
PID 4956 wrote to memory of 5048	4956	Unicorn-13019.exe	93
PID 4956 wrote to memory of 5048	4956	Unicorn-13019.exe	93
PID 1176 wrote to memory of 2552	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	94
PID 1176 wrote to memory of 2552	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	94
PID 1176 wrote to memory of 2552	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	94
PID 5048 wrote to memory of 3936	5048	Unicorn-55043.exe	96
PID 5048 wrote to memory of 3936	5048	Unicorn-55043.exe	96
PID 5048 wrote to memory of 3936	5048	Unicorn-55043.exe	96
PID 4956 wrote to memory of 3740	4956	Unicorn-13019.exe	97
PID 4956 wrote to memory of 3740	4956	Unicorn-13019.exe	97
PID 4956 wrote to memory of 3740	4956	Unicorn-13019.exe	97
PID 3180 wrote to memory of 3868	3180	Unicorn-1011.exe	98
PID 3180 wrote to memory of 3868	3180	Unicorn-1011.exe	98
PID 3180 wrote to memory of 3868	3180	Unicorn-1011.exe	98
PID 4472 wrote to memory of 4876	4472	Unicorn-9371.exe	99
PID 4472 wrote to memory of 4876	4472	Unicorn-9371.exe	99
PID 4472 wrote to memory of 4876	4472	Unicorn-9371.exe	99
PID 2552 wrote to memory of 3904	2552	Unicorn-10340.exe	100
PID 2552 wrote to memory of 3904	2552	Unicorn-10340.exe	100
PID 2552 wrote to memory of 3904	2552	Unicorn-10340.exe	100
PID 4532 wrote to memory of 4960	4532	Unicorn-12547.exe	101
PID 4532 wrote to memory of 4960	4532	Unicorn-12547.exe	101
PID 4532 wrote to memory of 4960	4532	Unicorn-12547.exe	101
PID 1176 wrote to memory of 4620	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	102
PID 1176 wrote to memory of 4620	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	102
PID 1176 wrote to memory of 4620	1176	f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe	102
PID 1052 wrote to memory of 208	1052	Unicorn-50051.exe	103
PID 1052 wrote to memory of 208	1052	Unicorn-50051.exe	103
PID 1052 wrote to memory of 208	1052	Unicorn-50051.exe	103
PID 3936 wrote to memory of 2836	3936	Unicorn-60596.exe	106
PID 3936 wrote to memory of 2836	3936	Unicorn-60596.exe	106
PID 3936 wrote to memory of 2836	3936	Unicorn-60596.exe	106
PID 5048 wrote to memory of 4484	5048	Unicorn-55043.exe	107
PID 5048 wrote to memory of 4484	5048	Unicorn-55043.exe	107
PID 5048 wrote to memory of 4484	5048	Unicorn-55043.exe	107
PID 3740 wrote to memory of 3596	3740	Unicorn-5457.exe	108
PID 3740 wrote to memory of 3596	3740	Unicorn-5457.exe	108
PID 3740 wrote to memory of 3596	3740	Unicorn-5457.exe	108
PID 4956 wrote to memory of 2648	4956	Unicorn-13019.exe	109
PID 4956 wrote to memory of 2648	4956	Unicorn-13019.exe	109
PID 4956 wrote to memory of 2648	4956	Unicorn-13019.exe	109
PID 208 wrote to memory of 1280	208	Unicorn-57835.exe	110
PID 208 wrote to memory of 1280	208	Unicorn-57835.exe	110
PID 208 wrote to memory of 1280	208	Unicorn-57835.exe	110
PID 3868 wrote to memory of 3996	3868	Unicorn-27431.exe	111
PID 3868 wrote to memory of 3996	3868	Unicorn-27431.exe	111
PID 3868 wrote to memory of 3996	3868	Unicorn-27431.exe	111
PID 3180 wrote to memory of 3664	3180	Unicorn-1011.exe	112

C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
1⤵
PID:15872

C:\Users\Admin\AppData\Local\Temp\f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe
"C:\Users\Admin\AppData\Local\Temp\f2095448cace9adb3a3e02d38dcc10ccda0650fe066fcbdc6241a553b41b2d33N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12547.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12547.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20903.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        8⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        9⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        10⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        10⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        9⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        9⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        9⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        9⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        9⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        9⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        8⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        8⤵
        
        PID:17572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        9⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8667.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        9⤵
        
        PID:15072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55673.exe
        8⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        8⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
        7⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62015.exe
        7⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33485.exe
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52525.exe
        9⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        10⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56737.exe
        10⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1157.exe
        10⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29434.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        9⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        9⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41230.exe
        9⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41465.exe
        8⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        8⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51641.exe
        8⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59026.exe
        7⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        7⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35549.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21629.exe
        7⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64836.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40122.exe
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27165.exe
        9⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59486.exe
        9⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        8⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        8⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44949.exe
        8⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5856.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58081.exe
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32975.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        6⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        8⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37712.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52665.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37192.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49815.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42754.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        6⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15717.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11921.exe
        8⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        8⤵
        
        PID:17676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
        7⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        6⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        7⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        7⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34285.exe
        6⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47532.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        7⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        6⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53412.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
        5⤵
        
        PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        6⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34682.exe
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32564.exe
        7⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64585.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44896.exe
        6⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55581.exe
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39261.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11404.exe
        8⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        8⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57950.exe
        7⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        7⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-386.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
        6⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49835.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5945.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        7⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44601.exe
        6⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64905.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        6⤵
        
        PID:18312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        6⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56600.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        5⤵
        
        PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        5⤵
        Executes dropped EXE
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54953.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17109.exe
        7⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58304.exe
        6⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12093.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        5⤵
        
        PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19183.exe
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30221.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20538.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21826.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61833.exe
        5⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47624.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        5⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        5⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43805.exe
        5⤵
        
        PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60477.exe
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
      4⤵
      PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16509.exe
      4⤵
      PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36661.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1985.exe
        9⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        10⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        10⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        10⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52188.exe
        9⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        8⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        9⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        9⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4802.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9501.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        9⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63618.exe
        10⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        10⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        9⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57180.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53997.exe
        9⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
        9⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49979.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        7⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 632
        8⤵
        Program crash
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        8⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9592.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        9⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        9⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        8⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        8⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25764.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42837.exe
        7⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-740.exe
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        7⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56960.exe
        7⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52073.exe
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41581.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37434.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4673.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15925.exe
        9⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        9⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
        9⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33709.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        8⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53238.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34895.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        7⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42152.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32756.exe
        7⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5658.exe
        6⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39885.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36153.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64161.exe
        6⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        8⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
        8⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45113.exe
        7⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        7⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        6⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
        6⤵
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12369.exe
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        7⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19413.exe
        7⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        6⤵
        
        PID:4632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34954.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64413.exe
        5⤵
        
        PID:18164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29458.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20626.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        9⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        9⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        9⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        8⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        8⤵
        
        PID:18360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23235.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58547.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        7⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63490.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56820.exe
        8⤵
        
        PID:17104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        8⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44684.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6279.exe
        7⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5260.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        7⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40459.exe
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17568.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        6⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        8⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7884.exe
        9⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        8⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36728.exe
        7⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        7⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-465.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        7⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19186.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        7⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12522.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        6⤵
        
        PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27860.exe
        5⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37208.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11278.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28498.exe
        5⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28158.exe
        8⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22696.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        7⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        7⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        7⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29903.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        6⤵
        
        PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53225.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49474.exe
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48844.exe
        7⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18909.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        5⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2117.exe
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58441.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49136.exe
        5⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        5⤵
        
        PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30345.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23589.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10940.exe
        6⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6978.exe
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1376.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27473.exe
        5⤵
        
        PID:18348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43411.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7745.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
      4⤵
      PID:8048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44149.exe
        6⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        9⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40203.exe
        9⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21524.exe
        9⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
        8⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        7⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58937.exe
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5762.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60843.exe
        6⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61478.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10744.exe
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51318.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5424.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10748.exe
        7⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        6⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22035.exe
        7⤵
        
        PID:16448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34807.exe
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8818.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        
        PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40548.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        5⤵
        
        PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35074.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        5⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        6⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56528.exe
        7⤵
        
        PID:13944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        7⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50849.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58640.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12379.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1617.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-967.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        5⤵
        
        PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7968.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59760.exe
        6⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26042.exe
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17904.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33900.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34042.exe
        5⤵
        
        PID:14064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      4⤵
      PID:10564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47960.exe
      4⤵
      PID:14956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28690.exe
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        8⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54044.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        7⤵
        
        PID:17636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45088.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60489.exe
        6⤵
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        6⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21979.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24360.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61235.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10556.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35842.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42808.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        5⤵
        
        PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
      4⤵
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        7⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
        6⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57728.exe
        5⤵
        
        PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
      4⤵
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        5⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        6⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        5⤵
        
        PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60444.exe
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14314.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
      4⤵
      PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37649.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30418.exe
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17253.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24669.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        7⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59780.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1759.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52275.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17572.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43988.exe
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58848.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        6⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3202.exe
        5⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26238.exe
        5⤵
        
        PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62835.exe
      4⤵
      PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41986.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        5⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60637.exe
        5⤵
        
        PID:676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
      4⤵
      PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43221.exe
      4⤵
      PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        5⤵
        
        PID:18280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18453.exe
      4⤵
      PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
    3⤵
    PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
      4⤵
      PID:14348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28007.exe
    3⤵
    PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
    3⤵
    PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
    3⤵
    PID:7800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 724
        6⤵
        Program crash
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24863.exe
        5⤵
        
        PID:5072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        7⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        7⤵
        
        PID:18268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58980.exe
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24285.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6522.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52596.exe
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31461.exe
        6⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        7⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57283.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42453.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14300.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        7⤵
        
        PID:18224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50464.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18423.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59395.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8200.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36971.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        5⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15618.exe
        5⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29587.exe
        6⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        7⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12780.exe
        7⤵
        
        PID:17628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3266.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2632.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16029.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48809.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33960.exe
        6⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55700.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53532.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53744.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        5⤵
        
        PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
      4⤵
      PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        5⤵
        
        PID:13736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39693.exe
        5⤵
        
        PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32000.exe
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2665.exe
      4⤵
      PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16791.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
      4⤵
      PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28114.exe
        6⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        9⤵
        
        PID:16560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        9⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
        8⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32472.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50739.exe
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22996.exe
        7⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52549.exe
        7⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51894.exe
        7⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50629.exe
        6⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8824.exe
        5⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29677.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60276.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59419.exe
        7⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59373.exe
        7⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        6⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29685.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24509.exe
        7⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10779.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32554.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        6⤵
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16725.exe
        6⤵
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3075.exe
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7215.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1997.exe
        5⤵
        
        PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        5⤵
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59892.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
        6⤵
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        6⤵
        
        PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33551.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        6⤵
        
        PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57864.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49124.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        5⤵
        
        PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        5⤵
        
        PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56217.exe
      4⤵
      PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8590.exe
      4⤵
      PID:1028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38093.exe
        5⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34554.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11804.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        8⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5320.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61485.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59872.exe
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14299.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57563.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7624.exe
        5⤵
        
        PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20832.exe
      4⤵
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23825.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
        5⤵
        
        PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20551.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        5⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34404.exe
        5⤵
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9210.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51137.exe
      4⤵
      PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
      4⤵
      PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64763.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53469.exe
      4⤵
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48669.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19573.exe
        6⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7196.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        7⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44493.exe
        7⤵
        
        PID:580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44110.exe
        6⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17114.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        5⤵
        
        PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37459.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        5⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
      4⤵
      PID:15092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16594.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25437.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51449.exe
        5⤵
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58800.exe
        5⤵
        
        PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
      4⤵
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
      4⤵
      PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51973.exe
      4⤵
      PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58476.exe
    3⤵
    PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
      4⤵
      PID:18340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11778.exe
    3⤵
    PID:16216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55773.exe
        6⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        8⤵
        
        PID:17652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        7⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-864.exe
        6⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10800.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        6⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42155.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
        6⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        7⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15571.exe
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        6⤵
        
        PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18923.exe
        5⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62662.exe
        6⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28639.exe
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        5⤵
        
        PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
      4⤵
      PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49858.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        5⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64643.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        5⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60638.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56292.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59925.exe
      4⤵
      PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49181.exe
      4⤵
      PID:17584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54621.exe
        5⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7169.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35805.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55717.exe
        8⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29352.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47373.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28939.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        7⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        6⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45684.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35172.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19254.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21843.exe
        6⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        6⤵
        
        PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        5⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12476.exe
        5⤵
        
        PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36011.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        5⤵
        
        PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      4⤵
      PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
      4⤵
      PID:15832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      4⤵
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19587.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6516.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29523.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        6⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        5⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43885.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32979.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        5⤵
        
        PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5378.exe
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15880.exe
      4⤵
      PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32073.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15524.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        5⤵
        
        PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25466.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
      4⤵
      PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52357.exe
      4⤵
      PID:18424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
    3⤵
    PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
      4⤵
      PID:14340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37267.exe
    3⤵
    PID:10728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40989.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13505.exe
        5⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23890.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41331.exe
        7⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49012.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14292 -s 464
        7⤵
        Program crash
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64549.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        6⤵
        
        PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56604.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
        5⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2957.exe
        5⤵
        
        PID:18352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26660.exe
        6⤵
        
        PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47696.exe
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
      4⤵
      PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53561.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
        5⤵
        
        PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
      4⤵
      PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11564.exe
      4⤵
      PID:512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45163.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      4⤵
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19189.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        5⤵
        
        PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      4⤵
      PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
      4⤵
      PID:13832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
      4⤵
      PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        5⤵
        
        PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13459.exe
      4⤵
      PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15159.exe
      4⤵
      PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
    3⤵
    PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10952.exe
    3⤵
    PID:10708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
    3⤵
    PID:5672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61378.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-548.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        6⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
        6⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55068.exe
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47568.exe
      4⤵
      PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9780.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        5⤵
        
        PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2114.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57983.exe
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36099.exe
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38493.exe
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38648.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35444.exe
        5⤵
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      4⤵
      PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49795.exe
      4⤵
      PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41301.exe
      4⤵
      PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20634.exe
    3⤵
    PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8633.exe
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52868.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
      4⤵
      PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
      4⤵
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15187.exe
    3⤵
    PID:11312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
    3⤵
    PID:17596
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55214.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
    3⤵
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63853.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45468.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53088.exe
        5⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25662.exe
        5⤵
        
        PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63515.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21635.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      4⤵
      PID:5848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
    3⤵
    PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50242.exe
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12588.exe
      4⤵
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57372.exe
    3⤵
    PID:9988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58435.exe
    3⤵
    PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
    3⤵
    PID:14580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
  2⤵
  PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
    3⤵
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20922.exe
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46428.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
      4⤵
      PID:17616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
    3⤵
    PID:8844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46715.exe
    3⤵
    PID:13320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
    3⤵
    PID:15204
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
  2⤵
  PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8057.exe
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17959.exe
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
  2⤵
  PID:10416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
  2⤵
  PID:15020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 824 -ip 824
1⤵
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7668 -ip 7668
1⤵
PID:11196

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe

Filesize
468KB

MD5
1759ea197a8834160705d72816729dd6

SHA1
9d2b96e519b2b2f9abab195b38bc588569c0a65b

SHA256
64342b2c2f0843a0fe65d81dbb74715abdc1b3c4028c8e34755131f8f4e0391b

SHA512
81302b6bc769b5cd8b8de9f50ec182e0861c44f2964ef7f23b348f379f5c64a47a6f3cdff2978ef857cd59b0bfac7723a5e68b38794fc517406f155d0427c185

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe

Filesize
468KB

MD5
ae0e0ddff7078a8cffc5143976989358

SHA1
fb71f58bbdc4242d53c30aa3d67895e9525ffbff

SHA256
f16092975c75fdc58a7509a02334f250880dd3ee8885836c5ffb99b3fbaca71c

SHA512
5b96df7ad8b96220fd0467117e5dee9466bbd7344cb1535fae3fcfd7426ff2b54e5270467faa3f1b19eb1c3296d0fc99aeb9f425b7754732ded376e6f0698e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11691.exe

Filesize
468KB

MD5
2b6d9e7a5da4ef7ff92ce595d6ad50c3

SHA1
8ee4cde8d4aa75a9c09c3c5eb0f4278f6dbeb16c

SHA256
d7339752e34fa82cb3abc92254ab5e97d38b51f8ea4ef3140f2a13ac5b3a676c

SHA512
3eb46ac01135cde010151fcaeda93ebd33529c726f53210f44ef68372f311c2a751d36d6031f218a52940d23feadd6ea836c01f2b1f47739533196c2320a9388

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12547.exe

Filesize
468KB

MD5
6de6cb842788ca138064d55afeec8b78

SHA1
62114c1b4c85de4fb6217139bae7a1ece443b966

SHA256
a78166651b211858efbe4b1f60ca6e68f79ef254d52af1d0a73e967a016130fd

SHA512
730eb359cc556e269efe3cf465097cd9be4a65c5d2bf3366d6bcb87e7d2b1cfb78d6bd1a689204cef0e19db3412856630dfb6f5fadbc7fe3d47bbaddcd159b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13019.exe

Filesize
468KB

MD5
cc73d0eace9bd6e341d7a534a1412b7e

SHA1
2e2ae3ee9505d3bbe99331bd3b61ccd273a79690

SHA256
0d82062521668393dce1d4085621b03b20f25966007a20cd9eca860803e515b7

SHA512
9df70d40ecd39ec5e1a73decd708a4ccc56053770d2ffd42fdc273aff48a8357f372db7781627788959ff867b1066c2014eeb6073ac74605bdda77ff697c4c90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14580.exe

Filesize
468KB

MD5
3b40596901bdb60b70c7355dc21fb045

SHA1
57bfdca20c4bb0e8d9bbb280f7d69e6af9a9ed77

SHA256
5141948bbfeb1836bf34e7031816329c05376795a5c0a71baf8f53d1c857b04a

SHA512
2a7b1932fbaafddd46a0e40383a6e13a17562706b56de8af256237f0524b6f833eed8b528984f1c9aebe93b6fa92ed067e4892a0b648bdff3009b853732db555

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15733.exe

Filesize
468KB

MD5
629463dd6f687d7522004ec0805c83ff

SHA1
1ad025ca019174a0f51282000b54d047df334021

SHA256
c7dd27e3879d1a3ffac8298e5918e61a87f454999f3874ff26a639af2715ff5d

SHA512
31a4090270ca19c933276d8149c4ed834db080a176f30b0cd70992154642111b8b422cbb3d2adfb80d6c82dfd429afeb17ed691ad8f999718b7683f68931164f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18407.exe

Filesize
468KB

MD5
5cb5c5bfd4c3ba3561ed2d0d61bae7e7

SHA1
f532a783639a56bd885f51bdaa7e58c72c9f5bbd

SHA256
936fc6f61de94ba5cec3cd8b23b6076c4ce82e11e8ca6a77ea228a800370ff27

SHA512
6748247e8018448b68cd1e406c9956d390a4a7c068017be230f41292a19c9604fb0eaf6043e242705b814de9f172b6c5875f9c5471b59cfbbb58f37bcecf0db8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe

Filesize
468KB

MD5
deb007d8f95ddcfaac3ac30efdf87089

SHA1
96d512aea055d801f798b712070e13c88361f4b3

SHA256
0dc1c51fd7aae9d4ca00b95cf09465cdc89f2f229848f84a6fd14fbcef1a0191

SHA512
75e066fd6f512c235bb0793d22fbdcf7efd3eab3518f8f84429be31dd8e736cd0e539295b4085bb95628267f4216d3d5d6daaff232bc73ff83eefca1a039eb82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20903.exe

Filesize
468KB

MD5
10263638cb96b70bea0a675d725092ea

SHA1
b66135314264040f98c6c3fd4af8127531fc7f92

SHA256
29a4ba84530c6c3875554e8fa64bb5baaaa1cd4b3f2785ae5b8b512e7a73e2c2

SHA512
631b6ef12152be472104d23226dc264a21ea08f37f81fdb9ee6c79c5c75693c59dd07ecb04b34022d8b7e679239da6f1842ef6bd88d07437ed1c1dc50f38dd7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27431.exe

Filesize
468KB

MD5
2b9fc4626f0b1281dd5eb8591c15d63f

SHA1
31add74d60b24d1ad837bc154e3f333bb365274b

SHA256
9856cc897feffd7709784eb6399f097f98e4f9082a99c7f92bd314270b338d15

SHA512
4897b6d3536999b3fc46d88a6feca60a56e808110f55b6dc61cfba4a89481826887e22e428e1ff8d22e0ff3a1669ccd8e1225ad2083edcf1e25363b4365e1f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe

Filesize
468KB

MD5
dce4d8e40c24566d699cc1fd4fdf871d

SHA1
312013a635866a62b1b6c9fa188ed069cb20f8e3

SHA256
94123c822cec86d87a4bc237c916524299a07255ec093ae1f9955280329323d7

SHA512
68330766e2bae273c0f3887b89291808ca7889c30f79eddb69cad569a2b09a306487b071b0e2e8849bf55375c42bccaa094494eae205991d6e10f43cbcc8c767

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe

Filesize
468KB

MD5
b4a471877b8953e7fc35eacc8cdf5824

SHA1
d16bb2b9dbd99ffa7a456568f6c0a6367cd13df7

SHA256
e11a9e5d76fea09f192ef8a666a64dba61e67c995fc0b876a6cc1761f9f654de

SHA512
12d104db170d211a9fae9100fed5ed1d1dbc4581b7a7bfe045ffbb2375e5834067cdd9406ba1a01f42f4df8dcf461947a3a03141bfe09f8f3dd813643c9cf391

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34282.exe

Filesize
468KB

MD5
aef3094b38e1b9396b6bef32ef5a3fc8

SHA1
541013593f0b03863a511269daa4c12187c73bcd

SHA256
fc77c2c919c0ca509253669269d064f7c6d38d8be3ed7bb92af4e95c0536c6cc

SHA512
7888c69af3838ca5b57b767cee95254229499178aeb5286cdcf80d4bc64f036faaa2ebdc7e3dbb8e26df8bacb9f4ba7185fdede51fc5119929a358188671f019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe

Filesize
468KB

MD5
b177504b9a14a1c08bd948b919407ad2

SHA1
04f9f9a7ff466cae1b0c92e3164a30ebc29b2749

SHA256
7f6ab8e40e0cf3d36b86299dbfd085b92f50c7f6804e705766195e0b27e27bf5

SHA512
692ef1a97fe344fccdd965e0effbceb3a54bb078bab04d0d86e54717904c7ee0350fb2a5f2d89793c6e206fe140206e9aa2c5a704530a79e8978056fc99e926b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36668.exe

Filesize
468KB

MD5
c16b5a0c94006947cdd430273b0de3f9

SHA1
a4b472415a680a753b4e5ddc5949625719fa734d

SHA256
97c0e3a217be529a449d750ff8f5d3b04573788cf65c73580bfc57107277e276

SHA512
6482729556423b0251fb88d98840180aa73c79010034b865db941b07b5f05ab67dda315c7e34c74633ad5d069658943aa9c4d785b29729f1206ed8acab83fdfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe

Filesize
468KB

MD5
03c45ca63f0f3a2f5b75af749b06abf5

SHA1
07a9b24eabf968454958e2ac1b21d8601f90c304

SHA256
862c498d6db221f4b4d1d2886c36de1b4ce87fa4dfb8ba5f926ef6448e98c03e

SHA512
31c0165411329d245b1eb2e86b6ec8041b9b337a99a5070d68e49a370c3370881f74831bf26c18cc84491ae45f528d6d58168abf402362f554b41f9ec26fc3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45522.exe

Filesize
468KB

MD5
89c7b267769ed7d2b37c17015feef9d3

SHA1
7c8e872543e4aa6b5185df1693a5570756936512

SHA256
88d2da48a654db12eb54210268b3dc7d15af1eb2618ddd98b729b634dd573f46

SHA512
1967565db5c35a4f53de26ddcf9c9ca259abf8cb4e94a89df2a3996f9c7c1ab5b416df9bbecae7fba334e47c7545e56ad63f58738f19b709b114447e7a8b1deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4566.exe

Filesize
468KB

MD5
0dc3a3aa203e6da974986d782f2b1d88

SHA1
445d9fe45dee7a44e728c503ede4be44d1c4a70f

SHA256
4dde770c20fb75345a99da2de079cba7aa75350409a172800063233629560c60

SHA512
92eb1c32d6ad776cb9e36e00d1cab7e3d0d2df4efc124ac9e22b4fb4a94311497411f5f76c7c05d6a9a2c3bd18d76f8f596011597a98b472bfa7d016860da58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46964.exe

Filesize
468KB

MD5
aa223c73c7aceacf97c2c53628d60aeb

SHA1
3157017ace59663d91ea2d8826ce08d75aba182d

SHA256
a19f29fa04fa7bfd5a82a1e007fd48cc733f3c97292bf8926febf2573ef75749

SHA512
7e007b7a4619a7cb79c244c50fd6f15e2feb061c439eb27cbc13fb7aa9934c041e5ad4617e737e52b4e6ed4356fb9015e597dcf19312aa292aec70dd0ba241ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50051.exe

Filesize
468KB

MD5
254b52df8228dcb7ea1745562f958fa7

SHA1
f2fcca1b3ba7577dd793dee4bff35a8bc8140b4c

SHA256
da4ae4d31e038a582e147d9aefea661ddebf6ee911b98712ccab2c0a30c3721f

SHA512
2f818ddbec6710ebd8ebed8face3ba0139fcd1d14d95409dabc69ac5a1c05afd25c844e95420e09bb4300cfeab73b0207143dc94879f56057c8904a64bf8eb9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe

Filesize
468KB

MD5
81fa9b4ec8eefa6d755f3dc3b03af432

SHA1
32c26b76204c1fa6c07b61fb944c49ce0a40cea3

SHA256
48801692c39d2e1c737b56a713c05ddeeafc567a1e23ba6b2af73137ec5e7e50

SHA512
f31b70049c08d394e1cf14f5407c5c7a484ea1c296fd8a85c4d90c4c4fef9133bd75dd75b4c80d41deec63dd81201dfffd2e95278c03f8c0c648ec09eac1b051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53212.exe

Filesize
468KB

MD5
ff2878cb19be85d626a775bb6a3d9ce1

SHA1
a5dee675012d0cc2b2d0b267b0d35bf858fde964

SHA256
843721183a185cd4bdb3c68c92bcd4de670eec869ca3480b6d003dee9107d366

SHA512
26fdf4bd75db78a4ad927d9249dd070c4449e09df5e74642d29866e64923fd70744d8e1a2be05072ae80676350084682381c80f144f2dfd31e3588478ac98f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54452.exe

Filesize
468KB

MD5
15283e77b848bc4bf6579023e03ec87e

SHA1
cb36ba72a7418adee41f61d7851d67db202cd82f

SHA256
6102d201f466e705ef394014509c6e6dfb13a24efe4b0501315f74a9008e03c8

SHA512
7d942e846967ef85cfdcc33f4997f999ba152708263601572935a793c661a312c2bd2c69be252a05ead2aeae5dc94cc4baa9ed672cc39cabfed6b87d5a7d9d9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5457.exe

Filesize
468KB

MD5
c722f6bf279e5314fa0b868f65e8fb95

SHA1
679858e5bc483f131f3834820477437554897527

SHA256
664638dcb040e6ee2df43d87bd9878565996e5817e2ddc357629c08bcc817c5b

SHA512
f1c9722dd17ecf196b2b4e32e38a7759acabc32ea7a4571cfa2ef113131f92a340650fbc4eeee819c50ab452af7a56f152f3b2db9619a7a06a358ef7626509c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55043.exe

Filesize
468KB

MD5
07a7e9cba818449bf3184023c8d1a504

SHA1
9214d776178025b3c687a11103e711b23cb73446

SHA256
458c96188b583d850ff9195f2c427fc40bb6f9bed2316c1df4c0402b4a83ddfd

SHA512
bf69c42d51fa723a9b3c6efdd03d226faa858a80e0049a521e99ef07397f614648340d6826abb3e5c7efa69eef26a693c8bfded733eadce1bce6c130df9b6b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5635.exe

Filesize
468KB

MD5
3a74a386edc90ba666fb673b775a7146

SHA1
ce7335603f1387d821fefd98c4aaa5a65ef7fedd

SHA256
160899a6b0d80143b4d41dd57af8bf24541608ed898ddac0ec68fd9ce4ab6d44

SHA512
7746359f05ba83ab82f106953278da1732fdd4535000fa2263ba705c2a6f21005aa7c350ddbd086940f9ada0e805494474e18c367261d40a4cf4f49009db32a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe

Filesize
468KB

MD5
83b7ec27484759ccd5941e6df7f98388

SHA1
6fea61e5384073ed3a0578b467c57ec48f93cbe7

SHA256
b466be7445706868b89b7d6a60f1408d47883a3e86435771b2bcb4b62ab5e659

SHA512
b4950e0d6f7662569f6e1ae1c4aeefb537d09a0a048f40f7b9127a609a7d636ae12493c5c0f543cbfa21bc4ff141a2af357bbfefe01aaa5cec934142ac3d9ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60596.exe

Filesize
468KB

MD5
41dabb4372b46e61ceddf0844493db26

SHA1
783ab830e2719c696993e94967c3228364292689

SHA256
af5e35a261bd6d0eb266edbe5d1029b0f85efea446fbca70008d50b38e15838b

SHA512
c4d7d25d362699a2b7c3d06b8c65e1eaa095c497315aba3ecd9439b7299960b151771a7cb00ee0ceadc4eb063f2220ac420ac4a8364172c172c4bc15f8b5f0ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61084.exe

Filesize
468KB

MD5
4cbc7e32f10787497cae2296ab09c42f

SHA1
223434b0fbd5e19f6751a87557479b4a6a73d12d

SHA256
08639ff6d338e2fbc868641f7abf2289023194f86d553517bf4b1ab30a9b5d90

SHA512
f5a61b3c265ac83de234d311bf26c3e31b0886a425b76c6c792cf2888f50ddc84652a4337dc1d7e2306197963d54481101356020ef5b9ab37ccc37653bec363d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-845.exe

Filesize
468KB

MD5
74fcee1e59f9f1dd40f2869f91e2777d

SHA1
da5eae73258d7b64f1794c16044e4a2cecb293dc

SHA256
6edb80e3a437e67905db4a83447a67798f103c7ddc18f237d1a489a86ebb0823

SHA512
81d21e3e9e151dc14dbf628c44986f52cfb21cc8494b6c883cb7402e3f932c935f2022c653d3e49edbb6451c0a5f3a41c5dcd84f80cd3461a4f60d7cce2d526c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9205.exe

Filesize
468KB

MD5
67dc99c587550bb77b1d1adeeab3516b

SHA1
29bffd3065576651178e25eaefa949a32a237220

SHA256
fb48b2f675011a9471081a4f903fc92c547c4068c9dc4877811c3e4bbc0b3b4c

SHA512
e5064114adbccdeb81e94a5fc474f7f4649c08d7f419d90126b23c86bcfcd0ac9531d3461e1eeda92b67694d6ee593cbec0417ed92a8aa8b84e19ea4fd10f738

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9371.exe

Filesize
468KB

MD5
6f3619680225389cc2789c542a6c8dd5

SHA1
baac6c2345eef18442a573d464e19c9fc5847b6d

SHA256
b3e66a096232b4eb4bbff522983b6b8d03b4832ed96aa35b962d475f9f4f8094

SHA512
c270ea8aa670d63fe0a61c00627e9f93c1815cecc057c8e80fea5b8a5044430e097bdeba9422b17b7662fde5a1028f5d7e3e3cc46ec891400d73ab89c359e8ff

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads