3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe
Size

184KB
MD5

a3a986505488896b15fdd32f90e40910
SHA1

a5acd9d007e33422cc2a838847c38da4ffcebace
SHA256

3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738
SHA512

1cc94d306c861a1cd27a6c5a00f9469abe89bbc1e8f2e0f75873053e180bc452912dd6653df4aed03df53e308ec2331b0dc3084a057bfc15894890db450a6c84
SSDEEP

3072:MsuB8Co2Jjg9ZDn9rjPqGHwdlvnqXvGui:MsOoRXDnlqUwdlPqXvGu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4276	Unicorn-23203.exe
1640	Unicorn-60234.exe
3904	Unicorn-14562.exe
1444	Unicorn-48107.exe
4268	Unicorn-25640.exe
4288	Unicorn-31771.exe
1268	Unicorn-44770.exe
376	Unicorn-1218.exe
2696	Unicorn-30553.exe
1868	Unicorn-50154.exe
3044	Unicorn-6049.exe
4696	Unicorn-25915.exe
4340	Unicorn-19784.exe
4556	Unicorn-31041.exe
2424	Unicorn-14705.exe
2872	Unicorn-25827.exe
4884	Unicorn-3360.exe
5048	Unicorn-9490.exe
784	Unicorn-49377.exe
1860	Unicorn-50715.exe
1452	Unicorn-50715.exe
488	Unicorn-6345.exe
5076	Unicorn-26211.exe
2732	Unicorn-25946.exe
1524	Unicorn-3744.exe
1552	Unicorn-49385.exe
3916	Unicorn-15250.exe
3444	Unicorn-57937.exe
1020	Unicorn-55131.exe
4864	Unicorn-59962.exe
4904	Unicorn-53123.exe
60	Unicorn-44955.exe
5028	Unicorn-49786.exe
1824	Unicorn-52666.exe
2812	Unicorn-29003.exe
2320	Unicorn-11513.exe
4580	Unicorn-52355.exe
2072	Unicorn-19683.exe
2136	Unicorn-19683.exe
1928	Unicorn-3346.exe
4620	Unicorn-43233.exe
980	Unicorn-32297.exe
5064	Unicorn-43730.exe
3056	Unicorn-37865.exe
3000	Unicorn-24129.exe
1684	Unicorn-23642.exe
2444	Unicorn-53242.exe
1196	Unicorn-56122.exe
3416	Unicorn-6418.exe
4336	Unicorn-35369.exe
2176	Unicorn-47067.exe
2504	Unicorn-30466.exe
1184	Unicorn-49371.exe
3852	Unicorn-54202.exe
4708	Unicorn-16123.exe
4644	Unicorn-53626.exe
4172	Unicorn-53626.exe
5060	Unicorn-50641.exe
4756	Unicorn-40435.exe
4384	Unicorn-24675.exe
4380	Unicorn-24675.exe
5056	Unicorn-48987.exe
4036	Unicorn-42857.exe
5004	Unicorn-23720.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
8548	888	WerFault.exe	234
9016	8768	WerFault.exe	381
8632	888	WerFault.exe	234
11236	888	WerFault.exe	234
12672	11244	WerFault.exe	514
19032	15752	WerFault.exe	797

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1783.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5704	dwm.exe
Token: SeChangeNotifyPrivilege	5704	dwm.exe
Token: 33	5704	dwm.exe
Token: SeIncBasePriorityPrivilege	5704	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe
4276	Unicorn-23203.exe
1640	Unicorn-60234.exe
3904	Unicorn-14562.exe
1444	Unicorn-48107.exe
4288	Unicorn-31771.exe
4268	Unicorn-25640.exe
1268	Unicorn-44770.exe
2696	Unicorn-30553.exe
1868	Unicorn-50154.exe
4696	Unicorn-25915.exe
3044	Unicorn-6049.exe
4340	Unicorn-19784.exe
4556	Unicorn-31041.exe
2424	Unicorn-14705.exe
2872	Unicorn-25827.exe
5048	Unicorn-9490.exe
4884	Unicorn-3360.exe
784	Unicorn-49377.exe
1860	Unicorn-50715.exe
2732	Unicorn-25946.exe
1524	Unicorn-3744.exe
1452	Unicorn-50715.exe
5076	Unicorn-26211.exe
488	Unicorn-6345.exe
3916	Unicorn-15250.exe
3444	Unicorn-57937.exe
1020	Unicorn-55131.exe
4864	Unicorn-59962.exe
4904	Unicorn-53123.exe
60	Unicorn-44955.exe
5028	Unicorn-49786.exe
1824	Unicorn-52666.exe
2812	Unicorn-29003.exe
2320	Unicorn-11513.exe
4580	Unicorn-52355.exe
1928	Unicorn-3346.exe
980	Unicorn-32297.exe
2072	Unicorn-19683.exe
5064	Unicorn-43730.exe
2136	Unicorn-19683.exe
4620	Unicorn-43233.exe
3056	Unicorn-37865.exe
3000	Unicorn-24129.exe
1976	Unicorn-48411.exe
1684	Unicorn-23642.exe
2444	Unicorn-53242.exe
1196	Unicorn-56122.exe
3416	Unicorn-6418.exe
2504	Unicorn-30466.exe
2176	Unicorn-47067.exe
1184	Unicorn-49371.exe
3852	Unicorn-54202.exe
4172	Unicorn-53626.exe
4708	Unicorn-16123.exe
4644	Unicorn-53626.exe
5060	Unicorn-50641.exe
4756	Unicorn-40435.exe
5004	Unicorn-23720.exe
4384	Unicorn-24675.exe
5056	Unicorn-48987.exe
3744	Unicorn-32680.exe
4380	Unicorn-24675.exe
2164	Unicorn-63507.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4276	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	82
PID 3996 wrote to memory of 4276	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	82
PID 3996 wrote to memory of 4276	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	82
PID 3996 wrote to memory of 1640	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	83
PID 3996 wrote to memory of 1640	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	83
PID 3996 wrote to memory of 1640	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	83
PID 4276 wrote to memory of 3904	4276	Unicorn-23203.exe	84
PID 4276 wrote to memory of 3904	4276	Unicorn-23203.exe	84
PID 4276 wrote to memory of 3904	4276	Unicorn-23203.exe	84
PID 1640 wrote to memory of 1444	1640	Unicorn-60234.exe	89
PID 1640 wrote to memory of 1444	1640	Unicorn-60234.exe	89
PID 1640 wrote to memory of 1444	1640	Unicorn-60234.exe	89
PID 3996 wrote to memory of 4268	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	91
PID 3996 wrote to memory of 4268	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	91
PID 3996 wrote to memory of 4268	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	91
PID 3904 wrote to memory of 4288	3904	Unicorn-14562.exe	90
PID 3904 wrote to memory of 4288	3904	Unicorn-14562.exe	90
PID 3904 wrote to memory of 4288	3904	Unicorn-14562.exe	90
PID 4276 wrote to memory of 1268	4276	Unicorn-23203.exe	92
PID 4276 wrote to memory of 1268	4276	Unicorn-23203.exe	92
PID 4276 wrote to memory of 1268	4276	Unicorn-23203.exe	92
PID 4288 wrote to memory of 376	4288	Unicorn-31771.exe	94
PID 4288 wrote to memory of 376	4288	Unicorn-31771.exe	94
PID 4288 wrote to memory of 376	4288	Unicorn-31771.exe	94
PID 3904 wrote to memory of 2696	3904	Unicorn-14562.exe	95
PID 3904 wrote to memory of 2696	3904	Unicorn-14562.exe	95
PID 3904 wrote to memory of 2696	3904	Unicorn-14562.exe	95
PID 3996 wrote to memory of 1868	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	96
PID 3996 wrote to memory of 1868	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	96
PID 3996 wrote to memory of 1868	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	96
PID 1640 wrote to memory of 3044	1640	Unicorn-60234.exe	97
PID 1640 wrote to memory of 3044	1640	Unicorn-60234.exe	97
PID 1640 wrote to memory of 3044	1640	Unicorn-60234.exe	97
PID 1268 wrote to memory of 4696	1268	Unicorn-44770.exe	98
PID 1268 wrote to memory of 4696	1268	Unicorn-44770.exe	98
PID 1268 wrote to memory of 4696	1268	Unicorn-44770.exe	98
PID 4276 wrote to memory of 4340	4276	Unicorn-23203.exe	99
PID 4276 wrote to memory of 4340	4276	Unicorn-23203.exe	99
PID 4276 wrote to memory of 4340	4276	Unicorn-23203.exe	99
PID 4268 wrote to memory of 4556	4268	Unicorn-25640.exe	102
PID 4268 wrote to memory of 4556	4268	Unicorn-25640.exe	102
PID 4268 wrote to memory of 4556	4268	Unicorn-25640.exe	102
PID 4288 wrote to memory of 2424	4288	Unicorn-31771.exe	103
PID 4288 wrote to memory of 2424	4288	Unicorn-31771.exe	103
PID 4288 wrote to memory of 2424	4288	Unicorn-31771.exe	103
PID 2696 wrote to memory of 2872	2696	Unicorn-30553.exe	104
PID 2696 wrote to memory of 2872	2696	Unicorn-30553.exe	104
PID 2696 wrote to memory of 2872	2696	Unicorn-30553.exe	104
PID 3904 wrote to memory of 4884	3904	Unicorn-14562.exe	105
PID 3904 wrote to memory of 4884	3904	Unicorn-14562.exe	105
PID 3904 wrote to memory of 4884	3904	Unicorn-14562.exe	105
PID 1868 wrote to memory of 5048	1868	Unicorn-50154.exe	106
PID 1868 wrote to memory of 5048	1868	Unicorn-50154.exe	106
PID 1868 wrote to memory of 5048	1868	Unicorn-50154.exe	106
PID 3996 wrote to memory of 784	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	107
PID 3996 wrote to memory of 784	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	107
PID 3996 wrote to memory of 784	3996	3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe	107
PID 4696 wrote to memory of 1860	4696	Unicorn-25915.exe	108
PID 4696 wrote to memory of 1860	4696	Unicorn-25915.exe	108
PID 4696 wrote to memory of 1860	4696	Unicorn-25915.exe	108
PID 4340 wrote to memory of 1452	4340	Unicorn-19784.exe	109
PID 4340 wrote to memory of 1452	4340	Unicorn-19784.exe	109
PID 4340 wrote to memory of 1452	4340	Unicorn-19784.exe	109
PID 1268 wrote to memory of 488	1268	Unicorn-44770.exe	110

C:\Users\Admin\AppData\Local\Temp\3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe
"C:\Users\Admin\AppData\Local\Temp\3906df7e09eefc648924ab2e5cc4f8edd1496e31e7716173079ab81995c94738N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe
        5⤵
        Executes dropped EXE
        
        PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53242.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        9⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        9⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21548.exe
        9⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19788.exe
        8⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34425.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        7⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        7⤵
        
        PID:18860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52089.exe
        6⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21131.exe
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35947.exe
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58960.exe
        9⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        9⤵
        
        PID:18236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20689.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        7⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53231.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34810.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18254.exe
        7⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        7⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57592.exe
        6⤵
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26563.exe
        6⤵
        
        PID:18856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42075.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        9⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        9⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        9⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16773.exe
        8⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4117.exe
        8⤵
        
        PID:18900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        8⤵
        
        PID:18984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31161.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5327.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51207.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        8⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28614.exe
        7⤵
        
        PID:18972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29417.exe
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12964.exe
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5120.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        6⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17571.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60062.exe
        8⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        8⤵
        
        PID:18828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33109.exe
        7⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35445.exe
        7⤵
        
        PID:18552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64469.exe
        7⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58057.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53199.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36765.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19102.exe
        6⤵
        
        PID:18476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40353.exe
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        6⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        6⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
        6⤵
        
        PID:18848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
        5⤵
        
        PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49371.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16611.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        9⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        9⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        9⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-390.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26065.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39830.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        8⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
        9⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20070.exe
        9⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        9⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        8⤵
        
        PID:18728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44129.exe
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17736.exe
        8⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8550.exe
        8⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1931.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13790.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54202.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49091.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25681.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54144.exe
        9⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2390.exe
        9⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        9⤵
        
        PID:18680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37054.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12374.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31604.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39905.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        8⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        8⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
        7⤵
        
        PID:19304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18456.exe
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6095.exe
        8⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        8⤵
        
        PID:17808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        7⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        6⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13423.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58575.exe
        6⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16123.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35843.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29064.exe
        9⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        9⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51671.exe
        9⤵
        
        PID:19320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        8⤵
        
        PID:19112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45636.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16465.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19272.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        8⤵
        
        PID:18312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48442.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        8⤵
        
        PID:14936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        7⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        7⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13480.exe
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38399.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35246.exe
        6⤵
        
        PID:18568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        5⤵
        Executes dropped EXE
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57171.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        8⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        8⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        7⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23096.exe
        7⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11244 -s 464
        8⤵
        Program crash
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        7⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25325.exe
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        6⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25371.exe
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47366.exe
        6⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20292.exe
        6⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6943.exe
        5⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        5⤵
        
        PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20171.exe
        7⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        8⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55223.exe
        8⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
        8⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
        8⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47794.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4485.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35637.exe
        7⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56035.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13806.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        7⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        7⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53818.exe
        5⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49683.exe
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        7⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        6⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        6⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45282.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52711.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41083.exe
        5⤵
        
        PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41219.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58711.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55740.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1206.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        7⤵
        
        PID:18364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45431.exe
        6⤵
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44751.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23720.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48545.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        6⤵
        
        PID:18956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        6⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25926.exe
        5⤵
        
        PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
        5⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        5⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
        5⤵
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11141.exe
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58878.exe
      4⤵
      PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52355.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62739.exe
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        9⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        9⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        9⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11281.exe
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        8⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47756.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39521.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55960.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33142.exe
        8⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        7⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        6⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9122.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40880.exe
        9⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        9⤵
        
        PID:15752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15752 -s 436
        10⤵
        Program crash
        
        PID:19032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63052.exe
        9⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60069.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12307.exe
        7⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63922.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        7⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6819.exe
        7⤵
        
        PID:18908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        6⤵
        
        PID:18528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50641.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27926.exe
        8⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38326.exe
        8⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        7⤵
        
        PID:18840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        7⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1783.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        7⤵
        
        PID:18292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
        7⤵
        
        PID:19108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33493.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36023.exe
        6⤵
        
        PID:15328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59682.exe
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-866.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55918.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        6⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
        6⤵
        
        PID:18400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13188.exe
        6⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36261.exe
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39404.exe
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38542.exe
        8⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7323.exe
        8⤵
        
        PID:19148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31220.exe
        7⤵
        
        PID:19052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51146.exe
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53966.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42551.exe
        6⤵
        
        PID:13596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        6⤵
        
        PID:19284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58427.exe
        6⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        7⤵
        
        PID:13884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        7⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10497.exe
        5⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        5⤵
        
        PID:18684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35499.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        7⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        7⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26744.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        6⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7100.exe
        6⤵
        
        PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        6⤵
        
        PID:18124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42772.exe
        6⤵
        
        PID:15752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        5⤵
        
        PID:6920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54306.exe
      4⤵
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49963.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38445.exe
        6⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25760.exe
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52400.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18645.exe
        5⤵
        
        PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30840.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7789.exe
      4⤵
      PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58310.exe
      4⤵
      PID:18668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19784.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        6⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        8⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35798.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24197.exe
        7⤵
        
        PID:16868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        7⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60941.exe
        7⤵
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7278.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        6⤵
        
        PID:17124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52475.exe
        6⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26864.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        7⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        7⤵
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22024.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60304.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        6⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31827.exe
        6⤵
        
        PID:19120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15606.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36928.exe
        5⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        5⤵
        
        PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32297.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
        5⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30189.exe
        7⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
        6⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        7⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18188.exe
        7⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58982.exe
        6⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64581.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49905.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39470.exe
        5⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
      4⤵
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        7⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22670.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39758.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        6⤵
        
        PID:18708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46346.exe
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21246.exe
        6⤵
        
        PID:18084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28343.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        5⤵
        
        PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34426.exe
      4⤵
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22048.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32579.exe
        5⤵
        
        PID:19160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36440.exe
      4⤵
      PID:14752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        6⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        8⤵
        
        PID:14152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        8⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        7⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        6⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        6⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        6⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        6⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
        5⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18421.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        5⤵
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36713.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34219.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13910.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        6⤵
        
        PID:244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        5⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
        5⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39972.exe
        5⤵
        
        PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3009.exe
      4⤵
      PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53815.exe
        5⤵
        
        PID:18948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        5⤵
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21565.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
      4⤵
      PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
      4⤵
      PID:18512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46403.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30777.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65192.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        5⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        5⤵
        
        PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        5⤵
        
        PID:17032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        5⤵
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41871.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
      4⤵
      PID:17096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
    3⤵
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
      4⤵
      PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        5⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14236.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
      4⤵
      PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26291.exe
    3⤵
    PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
      4⤵
      PID:13664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
      4⤵
      PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49661.exe
    3⤵
    PID:9224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25038.exe
    3⤵
    PID:13772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
    3⤵
    PID:8948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48107.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
      4⤵
      Executes dropped EXE
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48411.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        6⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        8⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36686.exe
        7⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        7⤵
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48088.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22270.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        7⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52578.exe
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        6⤵
        
        PID:796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        5⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29838.exe
        5⤵
        
        PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42859.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32712.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23067.exe
        7⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        6⤵
        
        PID:18984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44972.exe
        6⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55296.exe
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        5⤵
        
        PID:19256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22672.exe
      4⤵
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44322.exe
        5⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        6⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34411.exe
        6⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61087.exe
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        5⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24793.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        5⤵
        
        PID:18112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
      4⤵
      PID:18204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53626.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50496.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25710.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9921.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57304.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        7⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        7⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        7⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55782.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65238.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53817.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57808.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        7⤵
        
        PID:18148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42580.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59727.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        6⤵
        
        PID:19268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27592.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34456.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        5⤵
        
        PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38427.exe
        5⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17291.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        7⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21532.exe
        7⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35977.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        6⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        6⤵
        
        PID:19080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61015.exe
        6⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64308.exe
        6⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
        5⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21757.exe
        5⤵
        
        PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        6⤵
        
        PID:14312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54303.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22713.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        5⤵
        
        PID:13092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        5⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45949.exe
        5⤵
        
        PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5125.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34646.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-231.exe
      4⤵
      PID:15792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30259.exe
        5⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        8⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        8⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33613.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
        7⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7093.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49448.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
        5⤵
        
        PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18369.exe
      4⤵
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-954.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        6⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27973.exe
        6⤵
        
        PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28001.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64668.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47097.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55843.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
        5⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53837.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58862.exe
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7662.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5754.exe
      4⤵
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16893.exe
        6⤵
        
        PID:16124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5772.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19373.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        5⤵
        
        PID:16936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30437.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        5⤵
        
        PID:18776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22639.exe
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      4⤵
      PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      4⤵
      PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
    3⤵
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16422.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30807.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
      4⤵
      PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9225.exe
    3⤵
    PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
      4⤵
      PID:11844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
      4⤵
      PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
      4⤵
      PID:16592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1047.exe
    3⤵
    PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
    3⤵
    PID:12208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46294.exe
    3⤵
    PID:3352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6418.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        6⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24544.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
        8⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27967.exe
        7⤵
        
        PID:18544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
        6⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        7⤵
        
        PID:13288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30174.exe
        7⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        7⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40807.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29108.exe
        6⤵
        
        PID:18768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38545.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44011.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14693.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20454.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20940.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62489.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21264.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55623.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        6⤵
        
        PID:18740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47527.exe
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7831.exe
        5⤵
        
        PID:19276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
      4⤵
      Executes dropped EXE
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43243.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39271.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61869.exe
        5⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64128.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        5⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        5⤵
        
        PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13774.exe
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29320.exe
      4⤵
      PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
      4⤵
      PID:18744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56122.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17379.exe
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52843.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        7⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3230.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
        6⤵
        
        PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        5⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35747.exe
        5⤵
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39329.exe
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2639.exe
        5⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64191.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11710.exe
      4⤵
      PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6915.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40929.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37972.exe
        5⤵
        
        PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
      4⤵
      PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8366.exe
      4⤵
      PID:18376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56308.exe
      4⤵
      PID:6952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
    3⤵
    PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38886.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
    3⤵
    PID:13552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
    3⤵
    PID:18260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
    3⤵
    PID:7128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40435.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18931.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19878.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24027.exe
        8⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44303.exe
        7⤵
        
        PID:18488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58546.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12772.exe
        7⤵
        
        PID:2008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47614.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9686.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
        6⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40081.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe
        6⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62084.exe
        6⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38774.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61986.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        7⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31695.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        6⤵
        
        PID:18808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36729.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
        5⤵
        
        PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30309.exe
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11471.exe
      4⤵
      PID:18756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49387.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10762.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26094.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60639.exe
        6⤵
        
        PID:4152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22675.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56922.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
        6⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31101.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        5⤵
        
        PID:19308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34212.exe
        5⤵
        
        PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21929.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20571.exe
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27424.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33038.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        6⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
        6⤵
        
        PID:18700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30157.exe
        5⤵
        
        PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33272.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63007.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22837.exe
      4⤵
      PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
      4⤵
      PID:13244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
      4⤵
      PID:888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 632
        5⤵
        Program crash
        
        PID:8548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 632
        5⤵
        Program crash
        
        PID:8632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 644
        5⤵
        Program crash
        
        PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
      4⤵
      PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25726.exe
      4⤵
      PID:17564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26922.exe
    3⤵
    PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      4⤵
      PID:13376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38937.exe
    3⤵
    PID:8664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
    3⤵
    PID:12180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
    3⤵
    PID:17008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28539.exe
        6⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45063.exe
        5⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        5⤵
        
        PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55858.exe
      4⤵
      PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44383.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65252.exe
        5⤵
        
        PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
      4⤵
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63095.exe
      4⤵
      PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53958.exe
      4⤵
      PID:19252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18945.exe
    3⤵
    PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63715.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16806.exe
        6⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
      4⤵
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15261.exe
      4⤵
      PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
    3⤵
    PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13274.exe
      4⤵
      PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6525.exe
      4⤵
      PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52965.exe
      4⤵
      PID:2268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25786.exe
    3⤵
    PID:9152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41182.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40526.exe
    3⤵
    PID:17100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11513.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63507.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6081.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32800.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31341.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
      4⤵
      PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14825.exe
    3⤵
    PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48251.exe
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45047.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35726.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
      4⤵
      PID:17700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
    3⤵
    PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2670.exe
    3⤵
    PID:13732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57262.exe
    3⤵
    PID:18424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
    3⤵
    PID:7276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22050.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32963.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21206.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
      4⤵
      PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
      4⤵
      PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
    3⤵
    PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1413.exe
    3⤵
    PID:11692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
    3⤵
    PID:17176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
    3⤵
    PID:7036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45792.exe
  2⤵
  PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
    3⤵
    PID:8768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8768 -s 464
      4⤵
      Program crash
      PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5638.exe
    3⤵
    PID:11968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42270.exe
    3⤵
    PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12804.exe
    3⤵
    PID:6640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22998.exe
  2⤵
  PID:7928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
  2⤵
  PID:13024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50143.exe
  2⤵
  PID:17608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 888 -ip 888
1⤵
PID:8416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8768 -ip 8768
1⤵
PID:8632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 888 -ip 888
1⤵
PID:8776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 888 -ip 888
1⤵
PID:10740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 11244 -ip 11244
1⤵
PID:12312

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1218.exe

Filesize
184KB

MD5
31df17606a695943d23495f9dfc9762d

SHA1
2bc9b3d600f13ef149329d63e716b9c333b5f6b0

SHA256
41446b4aeb847947ad46b5e5fd6092a38f947301a6967797c242d3e01958fcb6

SHA512
3560fa28431961dd65d867ac7e70879f1e719d4561a2e3e4f3d7549e19a1c7440f991124e14090a7039b49df378d42b69db8cce8f96223c6af340afa07cd97bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe

Filesize
184KB

MD5
996845f65877dcd474a7507f6185a3c3

SHA1
a26066af461e077defe671bce62bade2a839ff53

SHA256
eab98b7a590b1c78f89b376efc83a8cc78f5221fe7c2d3ab2118304edcc73d72

SHA512
020db04977a5a3cc073023f2b8b9a5f58abc08e528083124ca25dc8c17ede0e3fb556483580894adc1eb8840c3767ed0d1763b700370c125e07116065c9901ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe

Filesize
184KB

MD5
0a076e6792c40c24c27509dcde1e3b9b

SHA1
e30232bd8d4d1a92cb394dc9796dc9df3454d0e1

SHA256
7e41be08880969d241f4cd966495b6eb01b0a2bbad4f4dd65a69d35081789819

SHA512
5a982a59e358dfc192af42146b9b30514853f0a2e932aba0740a5e6f4997208348b6f6f86b4b6bc9447ff802ee1037704fc6391c0670e42378f402453347ca6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15250.exe

Filesize
184KB

MD5
930307d91e8e4814fa34188940dd1d28

SHA1
80dd5017bb161bbfbde98fd528b3d72e5a17b4ca

SHA256
5c8b0fa4c715230e86e773afed84e56d928cfe54db3044c766b2efccdf8ad0d0

SHA512
502f1ff8c48cfde720155e46c0fee728a887d064c420937d98ab54b68a93bd6f6f6f03d09467f9161bc116b17e39b4c60391a31354611896f9d19368073edef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe

Filesize
184KB

MD5
bf43c7f071540a0f1764bc6dde8f0f57

SHA1
8e319456e55cdffaf28b63f67b0e872000edc224

SHA256
4620de23e2117ce71fd6f6a29da32f908c3a2e007abcf518011ccdbc987bf45c

SHA512
833f3628b8c7123a9116d3eacc03d7a69b9f58cb6a97030b757130f41eea531d1aa88e76b92dcf77836233593983379d17d59653efbee62dc804861757b92c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19784.exe

Filesize
184KB

MD5
29c531376c7050cc8fb27078015b71ab

SHA1
54baf8969e45a1b479ca388ff2b5f42e677844d9

SHA256
c67d84c6282514dba9dc1fa54aab0f029423b7d349b74040d32decfbf7999c43

SHA512
a6cada7bef07d41e05a41ed5393f0150b507a22ff4cf6cd6f32da294cd2b75f3906797c3bcb4e4ab878af96c23ff02240a521ce548d31a04c9d6c292bb8d8ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23203.exe

Filesize
184KB

MD5
9cfd571e0e621d5e292bcc2eeebbddde

SHA1
4ab73de574e388b1acd6370fd27c455d24191b3e

SHA256
dfe85a5f644d2233f57744a6e1dda3c0ff3d9f8d58b69cc4be152ab6ba7ea413

SHA512
6ebfb494b0e3142826d02ecb7394bf195780122ceb7af9ac90bc2820b2cb26efbf0a525605007bf2ce0310faa1003861b13cce899b2adde74942f97745cf9cb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe

Filesize
184KB

MD5
3519f5f4d4c1067ff69e2f149e6c98d2

SHA1
8034281193706f8ed7c2b2fa6d298e50b7eea610

SHA256
7053452b08708cc173f9e21a4520e1e35beb6de94ff3cb1146da607def13f23a

SHA512
4f6fd84f86c215ed3b1cfdccc35287e5925fb7cde933c09175eaa8bb0132d1b7f0b135cda50a543055babb2520da9b68662fb92988ac75aa689eda3d0aa1be5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe

Filesize
184KB

MD5
8b137eeaf17dc76714dfa1df9860cd6e

SHA1
753596e53adfe5c776114f7b577214cecb109222

SHA256
15119c6b743c8a389f9a8fd345d1f744252224a18084bac15042ffc2d4ad216a

SHA512
e155a3c9f72791ac21fbb757392cb899f95e9546de5d1d2bccba28066ad2768f9376b3b62a6f5381939659a23be3783cefc3198faa8c9ce215c60a793ed8dd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25640.exe

Filesize
184KB

MD5
24afc7ecdc294512502eca054e6902c2

SHA1
a84b8765d5fc60b9a113e481b228a28d4540d4b0

SHA256
2ff9769f2ae42507e39ca2c62c927bfd53c5359cb4d51163b516bbe2c8ba6d9f

SHA512
4643582de1c5615c7e4c4db0ff34f2484130938b9eb6ab3b63cec5de6b12554267eb1de0b07945919da5f871b79acdb8f915e311122602927ff718e39207b200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe

Filesize
184KB

MD5
b3ce059d193b7196a26c737f994528f4

SHA1
1dfd0186b692d1bfe68e6c92e0a30884f4e6d963

SHA256
c6faf83125609805fb334feacddbe858fbda9c0c7bebc1d8a1f931e6aa5c2a7e

SHA512
a375b1df96e38fbff08714d2f5ef872895d780b82d7a1396b09fa966d2b2059fd608216fc894b0fdd3a9c120a67d03b69caa86461197ae041676c2650aa2795b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25915.exe

Filesize
184KB

MD5
ac262895afd74dd08b69c556b32a586c

SHA1
60edb4166660b64362696d39a1c0af8699ec94e7

SHA256
08f2ac448fb5c6ff7fc6fd2302b3769f64cf2760106297da98cf71216c432c41

SHA512
d1b17476a385ba4ccf4444a0faf486318a2b694c59e19619503e6fc59a373fe0099ea1c98c49272fa3ec28ecd9239cee2d45027e2fa06175e913eaf1274e9774

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25946.exe

Filesize
184KB

MD5
2a5b68c3eb846afa1692cea2180874b5

SHA1
2d76ed2174ad9823aa7afba1d6d8e349d57eead9

SHA256
7ef532b27d57bb807aeeb530503b779db27723b7995b00c24cd2cbfe6dede012

SHA512
55c724f5ca410467a96d0135a4464bb73d4563b2d8449b159af95845f2917bb44cca8eaee38381081681200111eacbd04cc69ab75cf710da74d9d52d36bcf379

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe

Filesize
184KB

MD5
d594c227cc92c174b987ca962a3f2a49

SHA1
3787163e347279071bb307f4f50f9dd9559e5c7a

SHA256
507078960fe6747566f417853e790366d503ddbf027cd8dcc85b1d09e4b3144a

SHA512
52f24f5fe8627e6d846cb91654fe0a014d6c5d6cf2b469ad4215ae4c7abf04d166ab6efcb808a34606281ee3f091146518e825f95f8ef6d224b801da254ff00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30553.exe

Filesize
184KB

MD5
e1c83e4e5f0fc3a9c3e296815a375d0b

SHA1
78dbd95c0bec58001cc12fd8e24543797a102142

SHA256
4f0e5b151e12a297b87087284c4802991fd95b6bb3d305d2509d5f4346928fc2

SHA512
1d0b32f23322c381fa3cf5821c0d8a1779e57da3afc627bcf910e4fffc33181c386f3f275f568d16336cb9ec5685ba3659feb4552a27157b3d5077de36200acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31041.exe

Filesize
184KB

MD5
3cddd3f8409f0f3fda9535d8cba833d7

SHA1
876e7d5b1a6398c9427e01173fab88e491fefaee

SHA256
dbccb5714a0332619c0eb023e7c267a3c8252c4e27a7ead76e4ee81811b00cba

SHA512
290a949c47cbbb0aff3920950854116cc147412a07ead9a601222a787ddad413dbdde35ec1698369b681b7140d9758e149e40f4eacb27edf98cb7c2db66dbf4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31771.exe

Filesize
184KB

MD5
0431bbe15fb68f97338f7691d10ef0f7

SHA1
0697e55d45e754955bb172da979a0bd0b54e74ec

SHA256
c56d618f8b7072e04bd47b430d3a80cfda4a0541631305d823e2233fc3558241

SHA512
10dfc6e5b5a1afd51cff82ccbf6b71e4183c44808917b5004e3f7b09722da3464898a3c5d6aff4bcf0bc27c3d2459b1388fbc1a1b0d4a69e2f9b20e48bce112d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3360.exe

Filesize
184KB

MD5
525d2601efe5f2a7df491bb913adafa9

SHA1
223d845efebd3302da71c063a7f6a3f13de811c8

SHA256
d5ca2feb2a626a76a37367a33a7563cf70175fac725e8c8a6689c3d4b72dd44c

SHA512
f7d32efbfe42e414fd013d16991eec57f9cef959895d62fdfe546c1481a80ad3f316d6b6567ecb5c7546d97001746e84b7f59925ff42229767e3396e6e6a6d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36774.exe

Filesize
184KB

MD5
325ec3f46297448f13a7863301dd6f6a

SHA1
7027256c67f97e2061204bc63326bf33ad90d127

SHA256
79f9de8780ba77e16ae47f36fc319232d97c40c57a2f88429293307687513ab7

SHA512
91303f3af50c3bba921ab496a7edd42282f7128a49bff62babe2d91da3db25a6505c2190f52e3d6363301dc1836911264e0de5937ef16d4c569185ed388ff384

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe

Filesize
184KB

MD5
a4bbdbe66881c32e080ca9eacc783e68

SHA1
c92f8b617ff11a01646f522b29ef3289605b7942

SHA256
4557165648c9b493543b434aaee037edadb7829d6d7baf722348d10d6c86765a

SHA512
20830e8e61711c03b725b51bae789766f778589e487c362a6fd11adcb1ddfb4d764891870eda17a6df31cb4afdf75a4000344a365a6f5e4327ce382f4cc0a023

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44770.exe

Filesize
184KB

MD5
eefacd9267bdd8ec2ffde7da39759131

SHA1
0d9be21ad8dd52ce33a1100d494cf52028913edb

SHA256
d6c96ef24416aeb4232cb10a24c131f5e51525c0ba6d113b7a8d485f08ae64a7

SHA512
c03b9fc6662cd9cda29622a69854e29d85dd9a6beb8164cdc7e67ccdc97952b38d7f2b01a59383962b607d005fd50ce2fbb786529dffe9b4dd5659bcccc0ab0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe

Filesize
184KB

MD5
a9db8d2dbb9daf02cc1a41acdb58f4fa

SHA1
782b5e7a4a89e31a4f3884f060c5bbcf36554bc1

SHA256
57357fdbf9e4c451a13044b72fcfeacde5d6d578df267ca2c805267395c3a7f4

SHA512
2c23a8b49ad88baef490d41be165a21aba274ef80a571a6714677d531783eb94b7687304897b3445754895c6c227b92bda8f91a40b5b6ea2076cf78aaa5c6759

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe

Filesize
184KB

MD5
639051a66156175ef0a2a91ce2c419c1

SHA1
1b6ffbd0d0f3d4b61b516b4bc5bca117d6a2d634

SHA256
96d13dc5b4e7b1622faab861db4c2cfe7d5a7a9a8654757aab6c46ab7163c23d

SHA512
71bb3c655130faf37ce4a6fc8b0210ee9d7c8dcc72de3d73be42e69a199f10f6798c0abb3f3a351c26ffd11219d3981fe840ed704e82ebcd6eac437079aa5bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48107.exe

Filesize
184KB

MD5
43977cb59f4c189497a7bacb211174b3

SHA1
d901e2b4a6750faf01b2380f307a6127158a3d10

SHA256
c50e261100acac36a9b2c563efac095f999116466733fd633bee9d3d315f75eb

SHA512
745f4e70839f23ebccabf16c7425ae013ad4d17985f179e1c2f46d6f8f1be603a9cce958aae866ef3fd9d57daa32ff6a5a2d5911576364c74054e8cb07dd85ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe

Filesize
184KB

MD5
041b67de906a67b3de301da866f78a07

SHA1
d93983710e9d43a78dce9b9ded074c15e1464fdc

SHA256
434e8eea50b416da1c68eaea94884e0404e7b088a3b5cfec08d0683e9118ceb5

SHA512
722cb1133545c41e1f78785669650655b1eff49122f02c9388bee865363fdf7f231946d2178f96f20a5f8026ac4ffabe2dbbeb0808a276739464b5a0de5a6a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe

Filesize
184KB

MD5
c7dd523be70bf8c9256278ce35cad75c

SHA1
a6e21c8ace007c4e8ac0a10a2761cdd196db90f0

SHA256
006a016db9f5b461ed6472f69ffc146c457157bf8c333c4467ad361ce4744385

SHA512
cb10b1ea596487eb68844073aca3ca1aecb942b656496b8fa3182f0c5d14e0e206696397ac7d0d36e90a6ef7b6812e24a6e1cb5a5ebf612169679031e17d1f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe

Filesize
184KB

MD5
f46a376ca3845f877d74ca424676942e

SHA1
41f69f1746ae496afa30ab421b291bf204df8139

SHA256
5e38b4164398f432b87cd304b04aba8bb9530ffb9a1da61673340526eb03487c

SHA512
ef8ea034e2e006b6b6a823b24fa7920c55337ed3aa052493d118e2ba414eeade6fd7dee942a55a86b12047f18cde90d990b984b302bc56426a521356074c7194

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe

Filesize
184KB

MD5
07f84fb50fce73668982d4f4dce9c50f

SHA1
96a74a2b1ceba40f3d13fe141ad77f942635b1ce

SHA256
f5c3a035b28859e84d499a0bba17f4429e9a8f97098f736e3c968a3cf74af518

SHA512
1bf115fae0f8a3c4b10ac1d0fa10bed8eae96bd1a41c5d355c3326be459760e81d40b7af4b7e3058d06963900cba1be024eda557ad324047f3a8e3ecf9b4b5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53123.exe

Filesize
184KB

MD5
50670b0bb8d2c102fe33711b4953d06e

SHA1
d566e4a82ae3a6dbea959fe781766f85bfb4afa5

SHA256
ccc96d833b835468bcbbc06fcf4cee377afbb5187f6a545324a118dbaa575447

SHA512
e5b1230e65edd79fbaba928ad4009824bb62e5b51e809b7fb656b74ec0f5a99f1d0b3b32397b2c1b6b88bb34bcbe2035a79c3f7870470a441f8cca6a541f7d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55131.exe

Filesize
184KB

MD5
ee921579056821753dca3fab0b03ae44

SHA1
33708a33f3ef00872617a6da43eeebd40d827825

SHA256
ce3d3af79471a8e9cf3f6b0389807e2cffe5b996e5341020bbe520b04a6453f8

SHA512
45d84c0ca68162545c90e6d394b0d8d8894942e4ed060e88de1ef992c1b686d74c8632a1066a2505a4aa4a7008d890f997f801bb71c9e06037ff60a48c22335b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe

Filesize
184KB

MD5
5a30acd10e978614f1c9ddbeb2b38d36

SHA1
dd2984ecb0df009a05d3172ce76b3e9b0c18ed72

SHA256
2cbb798f54bb22ccbcae22fbc4747c123af8a4584eabc5f9d5a3223a49e36d91

SHA512
84ac2f31084e9c6cf74ae7996d686823f6f956cd9bbd99e87d542bcc4f75ae620c9da685799a95ed258097d442a7ce1aa1a2970cfb696b1c7762d64649474be4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59962.exe

Filesize
184KB

MD5
34cdd8a283fa6f59f1b2bd5ef9a61c37

SHA1
e0e64a8db26211824f25306f97641c122d89392c

SHA256
e8b77e56dccab2831fefc79c1aa4cfaa981c244ecf6add4f8a95a5f30d5423cd

SHA512
eb83ee41ff6bb1fa4c01e374d41e1149350188a6266149406dab843d88ec72c0e244621f1b755087752b01ef31798594f863b03472b4c8ab51b1544887b851b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe

Filesize
184KB

MD5
31b05de7b23f6730ba2e81ec4ca9dfb7

SHA1
6843bfcc24df79ae52c54a95816e7500484170a2

SHA256
4f02c941cbe20ae61a339d1bce67caf5ea6d8846d99dd5daaff7ae5b42804803

SHA512
7d61ea43b70b310a742acc53a0539ef99f057cb38ef9a96060a90b8805b52f556843ac4bfdc20a3987b0d2b0e4d06668e7165b08bef40d607d0c51987cf35fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60255.exe

Filesize
184KB

MD5
726416ef6acda3bb2523260c56ea6aba

SHA1
78074ad67681dc9d22290167f51d83628094e278

SHA256
a96fd8527896deb5ff95dd7c69bbc76e879c1be0c43c44472f0ab69001f590d7

SHA512
ef9ab0153429afffc32099f9646ea27c0a1cbd0bfc2a95d7ea431baec0c074d91ef3626c6d483c47513c049c7b958995e3d283914b530a3864586a37a0d17e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe

Filesize
184KB

MD5
029e9aa2c8c3f4f07a8687c6c038da38

SHA1
ff8da0663014c6cca85914772c7318d98ea33bde

SHA256
cdcb47ab24f1864f451ac1ef4b968db75d954854013be151fa36227fd8afe220

SHA512
75bda4a063f060f9644b51cf392c0c8552215e3cacb52a966d9ecc3251870c372b5c94bdcb07c8758eab1d9bd09e33492cdb0a7bf2843c1128ccf9461d1621b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe

Filesize
184KB

MD5
64bc222322d098ee25fe1090dbcf66b2

SHA1
6c4b2bc72afa66115872f70dbbce67464dd9a0cf

SHA256
2eb420cf0ba636d2279a03cf2393abc7333fbdf45563f3d2d9988c97b1902e49

SHA512
9a3c78b5f740fd3bfa66f38dddb09c75c7b06fcde7bdd29f5a21dddd89b8a1401fe7671b9797f38f1287cbbf7cc42f5fdf2dbb8627a1ddd1f4cd21a33cec4997

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9490.exe

Filesize
184KB

MD5
97d34b849f2f1e2e54de60746d71e99b

SHA1
42e49f571f20b677fa3e5e02ce4b81a227ae21a4

SHA256
a7a4c91757ba1f5467594014ffef4f69467361da489f5f4411d9f0eb518e11a0

SHA512
1c6315f49e7de6d665c5f213088c93481f5a5184efd108d260aea5443c76efa63c9bbbe472e2221232ab7c91087a72660811514c9f25c036a74135d4adcb69d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe

Filesize
184KB

MD5
17eb527034ff3cabbec886b56d40d73a

SHA1
4f77f059ab2f3ea06f5e1a41514eb985c06f4c44

SHA256
dedcbcbde0b2bc3726d5927612b971368405cefc00b5759149726a47e111d07a

SHA512
8e85e7d8626af2666fb7ff0605ae975bc1457aeabe12cce663a8f4f982cbc60c1b9e9a7a333bcfb8ffab39589d04ff41569247c6667bdd28e3e0ee2183a2ccab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads