2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe
Size

468KB
MD5

b0bed5b846ea2b645fff351780ccc430
SHA1

ca0cc369ce5bee3210d8f3b67d6c7b85815f8319
SHA256

2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5
SHA512

0475717c65a8bdcf98b140fd6e7f7ca838c34c3709009ab9d0ab36a580575a8d107eea4b2a8543781d8239a778a54faf7cf7a4618fbe1b0d57afcba03c1dbf68
SSDEEP

3072:aqfnogKxj28U2bYZPz3yqf8/EC3jy4gZPwfICVvinJYqvtpHOhlO:aqfotXU2aPDyqfRF3PnJTVpHO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1712	Unicorn-29970.exe
544	Unicorn-33234.exe
456	Unicorn-29704.exe
4660	Unicorn-47297.exe
3660	Unicorn-1625.exe
2268	Unicorn-9793.exe
4036	Unicorn-19999.exe
3780	Unicorn-4225.exe
1436	Unicorn-28730.exe
2164	Unicorn-8864.exe
1372	Unicorn-25584.exe
872	Unicorn-61786.exe
1568	Unicorn-6455.exe
5020	Unicorn-20754.exe
4344	Unicorn-60177.exe
1960	Unicorn-44498.exe
3712	Unicorn-61026.exe
1188	Unicorn-16848.exe
3784	Unicorn-8872.exe
4340	Unicorn-36906.exe
2280	Unicorn-14129.exe
1628	Unicorn-59993.exe
3384	Unicorn-14321.exe
436	Unicorn-46994.exe
2360	Unicorn-24527.exe
3720	Unicorn-14513.exe
4460	Unicorn-13751.exe
3932	Unicorn-19152.exe
2536	Unicorn-55354.exe
2768	Unicorn-6272.exe
4360	Unicorn-53346.exe
3096	Unicorn-50201.exe
2236	Unicorn-6449.exe
1220	Unicorn-22786.exe
4596	Unicorn-22713.exe
4516	Unicorn-19640.exe
2560	Unicorn-33375.exe
3716	Unicorn-39506.exe
4180	Unicorn-32223.exe
1488	Unicorn-38354.exe
220	Unicorn-6065.exe
2108	Unicorn-43760.exe
2412	Unicorn-63626.exe
2128	Unicorn-56994.exe
408	Unicorn-16346.exe
3828	Unicorn-56994.exe
2172	Unicorn-37320.exe
4076	Unicorn-51056.exe
4192	Unicorn-45873.exe
2228	Unicorn-40280.exe
1860	Unicorn-57186.exe
2284	Unicorn-201.exe
912	Unicorn-29344.exe
3088	Unicorn-29344.exe
3636	Unicorn-393.exe
5036	Unicorn-56801.exe
3008	Unicorn-16464.exe
716	Unicorn-35104.exe
376	Unicorn-62401.exe
3952	Unicorn-42002.exe
3472	Unicorn-50170.exe
4392	Unicorn-36272.exe
3892	Unicorn-8975.exe
4568	Unicorn-23658.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
7128	5316	WerFault.exe	222
8484	2816	WerFault.exe	742

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6449.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20754.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3348	dwm.exe
Token: SeChangeNotifyPrivilege	3348	dwm.exe
Token: 33	3348	dwm.exe
Token: SeIncBasePriorityPrivilege	3348	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe
1712	Unicorn-29970.exe
544	Unicorn-33234.exe
456	Unicorn-29704.exe
2268	Unicorn-9793.exe
3660	Unicorn-1625.exe
4660	Unicorn-47297.exe
4036	Unicorn-19999.exe
3780	Unicorn-4225.exe
2164	Unicorn-8864.exe
1436	Unicorn-28730.exe
1372	Unicorn-25584.exe
872	Unicorn-61786.exe
5020	Unicorn-20754.exe
4344	Unicorn-60177.exe
1568	Unicorn-6455.exe
1960	Unicorn-44498.exe
3712	Unicorn-61026.exe
1188	Unicorn-16848.exe
4340	Unicorn-36906.exe
3784	Unicorn-8872.exe
2280	Unicorn-14129.exe
1628	Unicorn-59993.exe
436	Unicorn-46994.exe
2768	Unicorn-6272.exe
3384	Unicorn-14321.exe
2360	Unicorn-24527.exe
3720	Unicorn-14513.exe
3932	Unicorn-19152.exe
4460	Unicorn-13751.exe
2536	Unicorn-55354.exe
4360	Unicorn-53346.exe
3096	Unicorn-50201.exe
2236	Unicorn-6449.exe
1220	Unicorn-22786.exe
4596	Unicorn-22713.exe
2560	Unicorn-33375.exe
4516	Unicorn-19640.exe
3716	Unicorn-39506.exe
1488	Unicorn-38354.exe
4180	Unicorn-32223.exe
220	Unicorn-6065.exe
2412	Unicorn-63626.exe
2108	Unicorn-43760.exe
2128	Unicorn-56994.exe
408	Unicorn-16346.exe
3828	Unicorn-56994.exe
4076	Unicorn-51056.exe
4192	Unicorn-45873.exe
1860	Unicorn-57186.exe
2172	Unicorn-37320.exe
3008	Unicorn-16464.exe
3636	Unicorn-393.exe
912	Unicorn-29344.exe
2228	Unicorn-40280.exe
2284	Unicorn-201.exe
5036	Unicorn-56801.exe
716	Unicorn-35104.exe
376	Unicorn-62401.exe
3088	Unicorn-29344.exe
3952	Unicorn-42002.exe
4392	Unicorn-36272.exe
3472	Unicorn-50170.exe
3892	Unicorn-8975.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1712	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	82
PID 3224 wrote to memory of 1712	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	82
PID 3224 wrote to memory of 1712	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	82
PID 1712 wrote to memory of 544	1712	Unicorn-29970.exe	83
PID 1712 wrote to memory of 544	1712	Unicorn-29970.exe	83
PID 1712 wrote to memory of 544	1712	Unicorn-29970.exe	83
PID 3224 wrote to memory of 456	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	84
PID 3224 wrote to memory of 456	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	84
PID 3224 wrote to memory of 456	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	84
PID 1712 wrote to memory of 4660	1712	Unicorn-29970.exe	89
PID 1712 wrote to memory of 4660	1712	Unicorn-29970.exe	89
PID 1712 wrote to memory of 4660	1712	Unicorn-29970.exe	89
PID 544 wrote to memory of 3660	544	Unicorn-33234.exe	90
PID 544 wrote to memory of 3660	544	Unicorn-33234.exe	90
PID 544 wrote to memory of 3660	544	Unicorn-33234.exe	90
PID 456 wrote to memory of 2268	456	Unicorn-29704.exe	91
PID 456 wrote to memory of 2268	456	Unicorn-29704.exe	91
PID 456 wrote to memory of 2268	456	Unicorn-29704.exe	91
PID 3224 wrote to memory of 4036	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	92
PID 3224 wrote to memory of 4036	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	92
PID 3224 wrote to memory of 4036	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	92
PID 3660 wrote to memory of 3780	3660	Unicorn-1625.exe	94
PID 3660 wrote to memory of 3780	3660	Unicorn-1625.exe	94
PID 3660 wrote to memory of 3780	3660	Unicorn-1625.exe	94
PID 2268 wrote to memory of 1436	2268	Unicorn-9793.exe	95
PID 2268 wrote to memory of 1436	2268	Unicorn-9793.exe	95
PID 2268 wrote to memory of 1436	2268	Unicorn-9793.exe	95
PID 544 wrote to memory of 2164	544	Unicorn-33234.exe	96
PID 544 wrote to memory of 2164	544	Unicorn-33234.exe	96
PID 544 wrote to memory of 2164	544	Unicorn-33234.exe	96
PID 456 wrote to memory of 1372	456	Unicorn-29704.exe	97
PID 456 wrote to memory of 1372	456	Unicorn-29704.exe	97
PID 456 wrote to memory of 1372	456	Unicorn-29704.exe	97
PID 4660 wrote to memory of 872	4660	Unicorn-47297.exe	98
PID 4660 wrote to memory of 872	4660	Unicorn-47297.exe	98
PID 4660 wrote to memory of 872	4660	Unicorn-47297.exe	98
PID 1712 wrote to memory of 1568	1712	Unicorn-29970.exe	99
PID 1712 wrote to memory of 1568	1712	Unicorn-29970.exe	99
PID 1712 wrote to memory of 1568	1712	Unicorn-29970.exe	99
PID 4036 wrote to memory of 5020	4036	Unicorn-19999.exe	100
PID 4036 wrote to memory of 5020	4036	Unicorn-19999.exe	100
PID 4036 wrote to memory of 5020	4036	Unicorn-19999.exe	100
PID 3224 wrote to memory of 4344	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	101
PID 3224 wrote to memory of 4344	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	101
PID 3224 wrote to memory of 4344	3224	2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe	101
PID 3780 wrote to memory of 1960	3780	Unicorn-4225.exe	104
PID 3780 wrote to memory of 1960	3780	Unicorn-4225.exe	104
PID 3780 wrote to memory of 1960	3780	Unicorn-4225.exe	104
PID 1436 wrote to memory of 3712	1436	Unicorn-28730.exe	105
PID 1436 wrote to memory of 3712	1436	Unicorn-28730.exe	105
PID 1436 wrote to memory of 3712	1436	Unicorn-28730.exe	105
PID 3660 wrote to memory of 1188	3660	Unicorn-1625.exe	106
PID 3660 wrote to memory of 1188	3660	Unicorn-1625.exe	106
PID 3660 wrote to memory of 1188	3660	Unicorn-1625.exe	106
PID 2268 wrote to memory of 3784	2268	Unicorn-9793.exe	107
PID 2268 wrote to memory of 3784	2268	Unicorn-9793.exe	107
PID 2268 wrote to memory of 3784	2268	Unicorn-9793.exe	107
PID 5020 wrote to memory of 4340	5020	Unicorn-20754.exe	108
PID 5020 wrote to memory of 4340	5020	Unicorn-20754.exe	108
PID 5020 wrote to memory of 4340	5020	Unicorn-20754.exe	108
PID 1372 wrote to memory of 2280	1372	Unicorn-25584.exe	109
PID 1372 wrote to memory of 2280	1372	Unicorn-25584.exe	109
PID 1372 wrote to memory of 2280	1372	Unicorn-25584.exe	109
PID 4036 wrote to memory of 1628	4036	Unicorn-19999.exe	110

C:\Users\Admin\AppData\Local\Temp\2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe
"C:\Users\Admin\AppData\Local\Temp\2f0416069d1648e1141f4eca5893f877a53807b0029fbb91f616ce7e52d3e6d5N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42002.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19714.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
        10⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        10⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42845.exe
        10⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        10⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18119.exe
        9⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
        9⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        9⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39138.exe
        9⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        11⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32015.exe
        10⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        10⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        9⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43837.exe
        9⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        9⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        9⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        8⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25494.exe
        8⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36272.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3953.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        9⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
        10⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        10⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53437.exe
        9⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        8⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        8⤵
        
        PID:16604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        9⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        9⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29906.exe
        8⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4532.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        7⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        7⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50170.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2609.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54322.exe
        9⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40247.exe
        10⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        10⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        9⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43244.exe
        9⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26776.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        9⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
        9⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7588.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        9⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        9⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53428.exe
        9⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59536.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        8⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
        7⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        7⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8975.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        9⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61619.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23911.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        8⤵
        
        PID:18368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30853.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9272.exe
        6⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35122.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36707.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40592.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62150.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40398.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22786.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        7⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        8⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47986.exe
        9⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        10⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        10⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        9⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57636.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        9⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        9⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24605.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        8⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8888.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27263.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        9⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        8⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21592.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58546.exe
        7⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29464.exe
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        9⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        9⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        8⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        8⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42565.exe
        7⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15607.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57026.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
        7⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49081.exe
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-364.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        6⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14353.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45269.exe
        9⤵
        
        PID:18120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52921.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3068.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17100.exe
        7⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16627.exe
        7⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2597.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64564.exe
        6⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44980.exe
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        5⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49538.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36037.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53036.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26112.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28504.exe
        6⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36229.exe
        7⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36159.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        7⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33087.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36443.exe
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        9⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        9⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        8⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30026.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-397.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
        7⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45209.exe
        6⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52594.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41015.exe
        8⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-648.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-911.exe
        6⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        7⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54661.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12270.exe
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17395.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62565.exe
        7⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23526.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25500.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61056.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        6⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
        6⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44397.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        5⤵
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        6⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        8⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        6⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35932.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63008.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10485.exe
        6⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23652.exe
        6⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25461.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11548.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-823.exe
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45934.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50236.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47860.exe
        5⤵
        
        PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28002.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59078.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21813.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-267.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41536.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        6⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13851.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49893.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24501.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        5⤵
        
        PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27396.exe
        5⤵
        
        PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21354.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18239.exe
        9⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31132.exe
        9⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        8⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42954.exe
        8⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        9⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        9⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41517.exe
        8⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        8⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-75.exe
        7⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        8⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34782.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5076.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
        6⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62401.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12744.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9036.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18253.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63988.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26968.exe
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        6⤵
        
        PID:17752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        7⤵
        
        PID:17552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        6⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        6⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        6⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        6⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        6⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64518.exe
        5⤵
        
        PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39330.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        8⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54612.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52462.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3072.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63481.exe
        6⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43407.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        7⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25076.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        6⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12343.exe
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14589.exe
        7⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41577.exe
        5⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61295.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42645.exe
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        5⤵
        
        PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41368.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        7⤵
        
        PID:18260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17677.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24338.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52660.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35060.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23295.exe
      4⤵
      PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14091.exe
      4⤵
      PID:10968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6392.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15121.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49654.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12301.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55436.exe
        7⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18031.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        7⤵
        
        PID:18228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63220.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6288.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        6⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48229.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54853.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33938.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30010.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        7⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4224.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19716.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20023.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24693.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        5⤵
        
        PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38708.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1841.exe
        5⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        6⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
        7⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        7⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31835.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        6⤵
        
        PID:13704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14116.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6096.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21650.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51205.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19996.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
      4⤵
      PID:13828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
      4⤵
      PID:17348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50082.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46642.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36584.exe
        5⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        6⤵
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
        6⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51369.exe
      4⤵
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47678.exe
        5⤵
        
        PID:14332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44868.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30068.exe
      4⤵
      PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        5⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21620.exe
        5⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26547.exe
        5⤵
        
        PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20843.exe
      4⤵
      PID:18244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41720.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13865.exe
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        5⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21436.exe
        5⤵
        
        PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57941.exe
      4⤵
      PID:2408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21905.exe
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
    3⤵
    PID:11184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
    3⤵
    PID:17512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21700.exe
    3⤵
    PID:10884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6449.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        7⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18946.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6761.exe
        9⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        10⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36716.exe
        10⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        9⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60156.exe
        9⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        9⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41797.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28874.exe
        9⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        9⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        9⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37089.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        8⤵
        
        PID:18236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52447.exe
        8⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        8⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9588.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40716.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12152.exe
        6⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22994.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7766.exe
        9⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        9⤵
        
        PID:17828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        9⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        8⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        8⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        8⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57822.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        7⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5609.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        8⤵
        
        PID:17592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33539.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1332.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-260.exe
        6⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-615.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11561.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13556.exe
        7⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62588.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24192.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55357.exe
        6⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14944.exe
        5⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9273.exe
        6⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13644.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        6⤵
        
        PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43488.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6189.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28296.exe
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        6⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        8⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
        8⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10248.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38532.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-572.exe
        6⤵
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1710.exe
        7⤵
        
        PID:13136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27588.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4835.exe
        7⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2109.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53425.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53541.exe
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17544.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22276.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14396.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39418.exe
        5⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25994.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        8⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33731.exe
        7⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        6⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12064.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58029.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55933.exe
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32713.exe
      4⤵
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37690.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23261.exe
        6⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36717.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22999.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        5⤵
        
        PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13037.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
      4⤵
      PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35578.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        8⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1917.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15308.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12360.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
        8⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12921.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        7⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39272.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5136.exe
        5⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36155.exe
        8⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39813.exe
        8⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26421.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45257.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28503.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33131.exe
        7⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39868.exe
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44632.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56154.exe
        6⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28932.exe
        7⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
        7⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        5⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50911.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46684.exe
        5⤵
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        7⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        6⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60881.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20483.exe
        6⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48517.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
      4⤵
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23970.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63333.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50070.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1251.exe
        5⤵
        
        PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37047.exe
      4⤵
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
      4⤵
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41176.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        6⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        7⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11311.exe
        5⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10957.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30739.exe
        5⤵
        
        PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47690.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39689.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26095.exe
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
      4⤵
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23087.exe
    3⤵
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64130.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        6⤵
        
        PID:13564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38548.exe
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        5⤵
        
        PID:17776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13808.exe
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45829.exe
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17292.exe
      4⤵
      PID:6824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40480.exe
    3⤵
    PID:5316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 464
      4⤵
      Program crash
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2305.exe
    3⤵
    PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
      4⤵
      PID:7352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
    3⤵
    PID:12832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
    3⤵
    PID:16520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        6⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57010.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
        9⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17796.exe
        9⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44294.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24891.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39597.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8121.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65446.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        7⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59989.exe
        7⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
        6⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        7⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62373.exe
        7⤵
        
        PID:15920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21363.exe
        7⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41710.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49468.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21280.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25106.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        7⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56377.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35845.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34899.exe
        6⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25122.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31709.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27763.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        5⤵
        
        PID:9096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        7⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62292.exe
        7⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20676.exe
        6⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2952.exe
        5⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42743.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35165.exe
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        5⤵
        
        PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44336.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27322.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        6⤵
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61596.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
        6⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17176.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50625.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 436
        6⤵
        Program crash
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        5⤵
        
        PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48193.exe
      4⤵
      PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        6⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41901.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34115.exe
        5⤵
        
        PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19484.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
      4⤵
      PID:6792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59993.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6065.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25002.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60570.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3689.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5773.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50068.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51122.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        6⤵
        
        PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1399.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24428.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
      4⤵
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        6⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
        7⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        7⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
        6⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44132.exe
        5⤵
        
        PID:15984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22779.exe
        5⤵
        
        PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15903.exe
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26215.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20380.exe
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
      4⤵
      PID:9764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51056.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45858.exe
        5⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22935.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        6⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        5⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        5⤵
        
        PID:17876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        5⤵
        
        PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34839.exe
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      4⤵
      PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18867.exe
      4⤵
      PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58945.exe
    3⤵
    PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
      4⤵
      PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41413.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51314.exe
        5⤵
        
        PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-456.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42457.exe
      4⤵
      PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
      4⤵
      PID:8388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39528.exe
    3⤵
    PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20764.exe
      4⤵
      PID:17840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10733.exe
    3⤵
    PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23879.exe
    3⤵
    PID:16256
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
        5⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27898.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61841.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45978.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23363.exe
        6⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40157.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45068.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31140.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51458.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20179.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49773.exe
        5⤵
        
        PID:15960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25063.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        5⤵
        
        PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
      4⤵
      PID:13816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
      4⤵
      PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63066.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23127.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31521.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2656.exe
      4⤵
      PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56967.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        5⤵
        
        PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31237.exe
      4⤵
      PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3687.exe
    3⤵
    PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
      4⤵
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46701.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
      4⤵
      PID:17528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5344.exe
    3⤵
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20071.exe
      4⤵
      PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29508.exe
      4⤵
      PID:16508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23525.exe
    3⤵
    PID:12400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
    3⤵
    PID:7476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
    3⤵
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10985.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19834.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63141.exe
        5⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6348.exe
      4⤵
      PID:17140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
    3⤵
    PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
      4⤵
      PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
      4⤵
      PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
    3⤵
    PID:9732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
    3⤵
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56801.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25962.exe
    3⤵
    PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
      4⤵
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43290.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34786.exe
        5⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        5⤵
        
        PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43940.exe
      4⤵
      PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42572.exe
      4⤵
      PID:8392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3003.exe
      4⤵
      PID:10876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15948.exe
    3⤵
    PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39405.exe
    3⤵
    PID:16484
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58786.exe
  2⤵
  PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
    3⤵
    PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12596.exe
      4⤵
      PID:17852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
    3⤵
    PID:9480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
    3⤵
    PID:7224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49959.exe
  2⤵
  PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
    3⤵
    PID:17740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
    3⤵
    PID:10480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52349.exe
  2⤵
  PID:11260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
  2⤵
  PID:16616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5316 -ip 5316
1⤵
PID:6460

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20241004-0659.dmp
1⤵
PID:8508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13751.exe

Filesize
468KB

MD5
3f40de1c79f1fef9510d2c9ea7705088

SHA1
6174cd3bd7b48752a5f6831ff024ded621cf26ba

SHA256
4a734a0c90bd560390873d66e4c650680715f5e62679f99fe5e5358b9c34eace

SHA512
ec0947a51f763702fb0f6e668ad6171bd0fdc867cd362fb55624d9ef5b0f3d8704e210beca8d82ab1ebca3c3e02e0027d2793a63f508784407e884930068048b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe

Filesize
468KB

MD5
2a10daa53f1cdd6f84e2655b40c3d297

SHA1
3a05cd18ab4da4ebc2b5bd70e20d8ac05198cdb0

SHA256
83a3ef757e7f76516a9e55d1b8f49507c8db36a3b59a83ec6210c9e453c59a0b

SHA512
a9638388973f8449758fd393a41fb57d8c304501a575e70c6de2055527d86854f2ea9fc64b7627f3b6e02516e20268570f8b4b53e496194e3125a214169b1092

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14321.exe

Filesize
468KB

MD5
86a8aa771a8693dbf398dd08ad7b3af3

SHA1
d22a5ba00bca44fa734068b146a8f7850a9fbae5

SHA256
118e4beba44bee0283cf0331643d7afb11daf6d1ba617eb9e129551ad704eed6

SHA512
27249478ded648a861002601dd7f22491baab002338d398e527f98dc017f087ac9a5eb16e53e309f7ca03c450a10de821583fb434b9b5a3c4378e2891f5b63f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe

Filesize
468KB

MD5
cab5ed69f14e62307dce6a8cc8934d05

SHA1
18d17158c4a906d7ef47fa70eaeb5ad99c53a00f

SHA256
037ebf72a01bbb0832fa204b16835544b344b5e3ac2d1d8e36dd6b1209c4aaff

SHA512
775743f837b641c9ed59dcbab26dc88e05cf7d17594d9eef72f439fc4fb11840b8e776b930b41f6d3d26bd6639e856ffa725c4f6693e42b2ebb72f1ef4eb5267

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe

Filesize
468KB

MD5
f774c4681986b2f68ad9b93dde21ed35

SHA1
144e446307b69d04411c2a21363b74860040c6b0

SHA256
07c73f3bbae178a7eedffba91bc78ede59c3c6cfdd763e7154d94cd48e6f2e35

SHA512
3c4f4deb87091158a5b0631c3af35a5ca7e54f87d84b03c8d92329deb1b239c49e9167db137372cd831b187aafedcec101a0a5405d0069338544c7f221ac7319

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16848.exe

Filesize
468KB

MD5
3789cf06a53eafb8368c701ba6aeb05d

SHA1
37f94dc09a9d5e0b95431f4f2949665d4907ffc3

SHA256
14fc1cf362ac27a683ce89c0b8ac5d2dfe0f4a770eeac0583a15e9bf97776618

SHA512
31b7ab5bb077b6aecae4d3cc8c1d691cbd67668e638d60e30b1a33e2b680b4a3002baf8bd53feb1bb7fb874905ae40742cd442a45036883a4e54b39c28907fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe

Filesize
468KB

MD5
f9f2b70cfedaaa001ccced1f818bd1ed

SHA1
ec17502638be926da66a916e7bfe5460894b247b

SHA256
1db7f47fda0250ddb0cf0014afa345d7c01bcbbf1235dbe0706c52429ad9a9c0

SHA512
847d873ca42876b815fb3d0a2b4b98e94b1e4ac09edd539e42e1067b26920d5579351a03264f3e6e55693f7129c5cad76ec9a60a8d4db3d95b51cd297946b6b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe

Filesize
468KB

MD5
a6b2adb26490414df539b94148d7cbfe

SHA1
2de7cf8b42e94d7526640cf44ff32565427c14ae

SHA256
ff4aec229e2b1af9c91e931b1b899640f2df5c37659bc7d04ab50513ec570d78

SHA512
29ce789c3b87cbef4eca9c235a3f4ed482153c2e6f8a06667de211c50c17c9fb73c87251dbf927fe2ffd486487b544baba5d1bb8e1a607f7df121dbe62db829b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20754.exe

Filesize
468KB

MD5
e2e93ff7e0adf70078505035901f5266

SHA1
2ce83fe536604cc32c3b2e532d4e7021ca07b167

SHA256
ebd4e6032e8a901f9f0af2e1222be8cf6f866ca5cdb1be72b6598c4ad5716556

SHA512
81b9d6f3a813135df0cffcc997344a8e89eb5b14c115c61d4cb8d254df0381388a475cf8041d8b3d7f46e137c330bb48a71cd4a6724957971f9432c47ab17733

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24527.exe

Filesize
468KB

MD5
f7c509eb2940099fbdf16ec0e3b9d833

SHA1
b4068948bedceaf2e55a99b04049d7cd3abcce33

SHA256
4a7272f85f7e20395f2ed1dc1fee550383ffbc0bf5442809c874d24eda2acdfa

SHA512
42fd9abbd7b6a86072dd4d7fba9308c70bd5fe795269f491e7099380521056c9e99d493d7289c75ce677181e4c8f8add8ba7f54a7a38875ea16420020ef0687e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe

Filesize
468KB

MD5
2db8ce7a0cae0afb71346585ab947cd3

SHA1
7b689e6f7ac1a5292d9294dd572788205d8a09b7

SHA256
106284067fdabe21bc26165ea5e45ea381988b5d0d15df0878d50dcf1e7f5734

SHA512
f316194185263abe30401b53b992f69a0d950c402425bbb2823b62d8896e737385b00141c0e23c84ec6578b99bfa3b482e4dbc87ccf4b5a05acdeafcf5111e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe

Filesize
468KB

MD5
899c9ea41c46c8c477400984c121a85a

SHA1
6a686d59d6ea5e14aa55cf2c26c4f512412ac549

SHA256
9da08c023be7a5481a7a239fbf6451c9e39929b7d2ec4a0d172d571e8e40f684

SHA512
0bda570ebeee6a849f531d294087e054a05af212d0371d7ea3d556a3c8457f77313a1f00cfb4123731637d2b7e9bdf1c0c1899e5b31b2daa04b3669da9cf4eeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe

Filesize
468KB

MD5
25288560aaf9e99dcfa91e1386aff421

SHA1
f709c0b5dc23b4c0ff25eb3d761366a543475840

SHA256
23bb558c3351f55e41a0c0015f66d7611566fdd734f92fa16361df7e59738820

SHA512
35a80e5498951dcb8cae1dae48633ae7bb32881f52f91977fb2e5117bfe1ea1e74e26d6fb5d7c68c02d51a18824b852a17ceda5c7830df8afb2259d06f3f7ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29970.exe

Filesize
468KB

MD5
576261333fb53e3310e669c31fbcb8b4

SHA1
415e50ecea5287202aa237961dacfc8c702c6449

SHA256
1ee3ebb0aff8302c91662cd9be3b4490564e0522ce199297e2fa2b9e860909ba

SHA512
f8fefaf8ea9920a7a12fd2819d791d0c8bfb2d737b5fa0828b5acd2bce946f5f6ec20b2f165a06cf47264cd66f276a15258f5f5dddafad2ac8344ab7f7f30d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33234.exe

Filesize
468KB

MD5
c4bd5b65bb30ec3ca4304c1f203ea03f

SHA1
05a1401dd46a04e03b0a4255af95eb8aba0a9a1e

SHA256
fc032986541bbe8f1aa48cb69bfa47aeaa90aeedbc45d8b46862c239cb1a81f1

SHA512
eff546a25c29f5bcb664ed5e320435d2ab4bc0afd382a2325573b2ce361eb5364c0e3b6a3f40eeeb05aca3a10e63f412b7f0bbf7df1abd9a958a482e22095b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe

Filesize
468KB

MD5
a23e417ab994b943ac8890e4ad5a1c98

SHA1
663380a18849b6cbd78cb9423c2de61fef3b4673

SHA256
9494f35e545e1a5b2a08696cd445b7fd24fcb06be5cd05d0fbdd3d50e1fbcb09

SHA512
238ab4d45e282b56ce238ba42599941f3d159c83e4ac21d96b238c6b85daf464f29c873ea0f90234c9d11bb10053618fe83f3c816e063c68811ea030fceb1f3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe

Filesize
468KB

MD5
7ceec7d5b0182a8aedb74727039e677d

SHA1
9931dda6c1c52d813a87c9dd01af9fb6a34e44fc

SHA256
2df766be20249f876f49ce1434f6af317df346e720c58d9214ca81857361639c

SHA512
bd97f8e7e0142ea741c5e5a26f7cfcfffbade991a20553b3405bf8f7e22afc6667c432f0f1b13e43664d7b1229fa8e761db38c1abeb461fcbf5cbdab6fe62c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44498.exe

Filesize
468KB

MD5
9bc2ec5f1c7bdfa5a061bae45ec9e54d

SHA1
cae4cb839e0c1a32fff403c35e5dc75b445a312f

SHA256
74947cc3f212343bc821d45b59db271774519cbb09c81a76efccbcf7c488ae6d

SHA512
57e9b37cda22e9848674e040a47a07a76a6c15962c13a463a8d2d1b41df2107b9bc2e9b9dcb88426619be1391602e5a76f36838d6f38f8fe2a12ecf626bffffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe

Filesize
468KB

MD5
d723eeaf99b6cdd2d2883c8b3508e7f7

SHA1
1355e7d64371db4ed731edf00a8898dc5e7d5860

SHA256
26270a665f5f3fb88fd585bed2849070e5f3c2e7bebb6e50483d7e8cd1f6a4d5

SHA512
473d94a5626ea7b9419dada900c6d67a627bfc918c05f228398fb0f2f6fff24a4d10938c67e19a0542f3439de887836c90fcec9f23c0ee5196b236763d8eaed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46994.exe

Filesize
468KB

MD5
b1f6d1087431e67a01d42a68fa25e5c5

SHA1
42bec5e77fee8c79d77f9a0ba6448b868dc27003

SHA256
2274d6c13d5261c34d861eead6428b1de60ea4c9f3f478fd0db2a692f470a434

SHA512
c04b397a023d371943baaf980f89d7623887ba78d7b6c56cbad9f7ab74f31e3ca0cae867e4ec75822814aae9fc0832d3ae9a92d88d8129af6a42d809e56bcc55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe

Filesize
468KB

MD5
95c9668987306c108233a10582ec3280

SHA1
192e09ec97e149b7e632c086f4cc7c3d03fa5304

SHA256
64c785f08ce9cfa2ef86078c663a4d29133d7d1ff395a15b7e988bd4dcbde027

SHA512
7ddbe4b92de74a02f4df263beaf65cf19d98decac140feaf28ab4fc20dd8dcef321d5f046bff54151ec015ebb592e1ded0d4307f9d73a3a74fb32eb7fd1d4ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48607.exe

Filesize
468KB

MD5
14570926070a205ae084d10f0499fc48

SHA1
0178f3f56e619a2c7dbb37e9a6118b443dad061b

SHA256
94c59973d50eff82a1a312402aebcb2f60e8f900c9bd74b53bd8f71abaab473e

SHA512
41d6533091e9cc5d40eeceba29bf79b47aefc9934d142dc8bf9315c3d810d13932d3be350c3a6b0f0479fd3c75410116789493b34a484b581c3868f243dea046

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe

Filesize
468KB

MD5
737c7bd9dcb9cb3a1d744787a557a0ce

SHA1
a2db6d6bb6095a24671cbf15c3153f8058a5668a

SHA256
47bb546b3e284a8a9bb25738767262cd84db238562a14a4dc4e8e8177f830224

SHA512
88bc7343f9f3b75b6ef45642ae74a46941ad79c07fba5a2c96297aea60a501acdb276b9c1adce2eff71dcfede8c9ae585d39ef2d004b17bdcfd15eee57b1467e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe

Filesize
468KB

MD5
af3f0201f559d0eef755a7ecdf184e78

SHA1
98bd68d2d817775f12610700d0d051965dc50df6

SHA256
c67b23d805549733f9056463446e62c84f9c84c3e1b865cd9a4caa9602517122

SHA512
0f8052e39c02bfd5264cb641249b23d3edda7929930d4bee562ce0fb7a4564b586d55b964ab35f44d5aea8243fb65ad36c1c124320571dcb804a35143ede3584

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55354.exe

Filesize
468KB

MD5
e54d058b1966425eb03ebd045c6bfb93

SHA1
7618453c565ede114364bf173969c15af6bb6a23

SHA256
85b19838ae11b8db6841eeaf229b50ba965b9024aefad4b9ac6eff7c1958bd19

SHA512
ec234b90d83332837c93fcb3a35136d2ed7adaf3b88ac4b083ce106bad984f2ec0635c5c94fc18e04f8b10e1fbd6a1e9119a72010bad86539c91605d0055ec31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59993.exe

Filesize
468KB

MD5
929eaf8ad24519a5e1452677bc1aa04c

SHA1
b486b83ab7918f457917a59a71a39ae5cb7e9a89

SHA256
c48ef48440ca71724854320b8168265514bd2f485edcca359f74ba4f36fa60be

SHA512
be33f0a16cca903c176bdff59b9b9dda5bf5d91e7112dde4b9e7bc2083b40638082e13128f3e6160c620fe21383a6f58c3afcebff58b9373c6b601bd69207187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60177.exe

Filesize
468KB

MD5
467112ff0a4034e53d533a70b7f8f921

SHA1
4c48e48caf0d36d024c538e9920203eb34fc2f86

SHA256
c62762bee0f69eb85fc49f90f450818e3eece5f107ec8faf86123a721ac85fee

SHA512
03d1120bac7259cacf9b8633218e43980153386189c2478d1f664c3f2cf5a7d44c14169a9b46e57c7887ff045a5c235f03cf600d6e3bef5c887877ab87464054

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61026.exe

Filesize
468KB

MD5
1c626aa99aebca452784737c00db93be

SHA1
e0be52456b6fed4acffa8f36477b73a045fcfc0e

SHA256
0e5a6060ed0caf194d09061e2904bc2ce6d9ce47d4c2e252b1bf65b3d889bcaf

SHA512
42dfa1681354d2f148bde715344b517ab8b05a1c8b612d8b92b9e76f3dd93e33d1e6d8d65be7ac1c68901b2a8313088197297617afe69177a75dbec323854411

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61786.exe

Filesize
468KB

MD5
11d16a9d115d0a3939fdc24d73e1a2cd

SHA1
cb552a5351d587a91aaf71d082452d1d03516702

SHA256
61d75c0cb74fe851256af253c1f83fb5fda016b04865da89ad0e012981ee5b39

SHA512
d25ad1f857611cd0cd2012965f36514a34a5793b3009653e76ecd489c692943f0533847bf94b3b93eb52aeb7875f4a5da399eb969db4558ee3ce8762c8342758

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6272.exe

Filesize
468KB

MD5
9c69a92cdd5aceb23253f9bc79c0d0d5

SHA1
d173e242ebeff51cb0a25f2d99625e9d3b6daad1

SHA256
b21968f4e4b72c1e4787f4305e355bd2a1b636551d4521f6150bf5b306d29c2e

SHA512
b2619b5ed292c922eb7f3d81eb90136e48f1e408d8ab78a1c203e6beaf555acc3139c155bd50f81f137b5301b6c57240ff3074f73ab3992ace817349893a8ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6455.exe

Filesize
468KB

MD5
426ec50f622e40d70e44a7280681494d

SHA1
cd12d80e5896197c0d47797475b1e7451a6ea113

SHA256
1caddae6c87aa106933ca8db6d231e945cb8d8161cb38495c5502e2f0f2d0ae7

SHA512
dc372743bcd9d5c9162ff6177d0e64899cf74e54ca8123f466c503ef8584f64fabe069f600b831b3f1a091b0519eb24a6f72bdbed9502f4b0a1ed7c493ef691c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8864.exe

Filesize
468KB

MD5
5508cf072ee51ce5da3eb83ac81c5383

SHA1
e73509c14901839d551633de9aeacb519dc9d20c

SHA256
8e5bcefae1d8c6e2c5d7ce966b9fba76999ada2d06d3366274e91fbc16beb865

SHA512
762fa882d94bb6f2d85fe8a372ee4acb6bc44d1c64353f2a0805334a0dba93857feee73320e3fd78a8cdfb472488b928a5c6ae454e1818c2b2c0072af34042ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8872.exe

Filesize
468KB

MD5
d901e1930d4ad544cadcb42b5dad6686

SHA1
84d42701dc97eb45f90c7c5f104cc7f308a4626d

SHA256
ea039c288888b9ac7e00edaa835282492b6ceddead25195a71311ab977e41de0

SHA512
6e2d51ca2b02e96cfdc68ba772daee678b2ccf92195650dbc28f15dd9a700d0a03d0ae2c6a52bfcd3ddf4549fdf1a4377f2bb146a79655b325db82bc02e117da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe

Filesize
468KB

MD5
a1179bfa62783201ee022f07aa6f0a4b

SHA1
fc660c9bdc0f634e6ae72538fcaf1321ec0bb6b4

SHA256
a5b0544e3e10870a4c9cca33d512eb62409ec20033b194d99d79366da7dc15b7

SHA512
8a2c7a075880fa1b0eb26bf8165a8615b96b7f726a988db9016c3a5fc44273f7089f8d52cce1d567db9093a6ed83f46fdfcc28434d639a17729822976449143a

Download Submit
memory/220-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1188-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1436-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2412-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2928-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-3395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3780-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3828-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-204-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4036-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4092-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4516-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4568-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5020-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8420-3644-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11084-3726-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11148-3727-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11736-3682-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads