a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe
Size 468KB
Sample241006-m4py2svdne
SHA256 a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7
MD5 4d1066537e3341c48ba2a04aa0ed9aa0
SHA1 106446915d78999a0c1592b53d5241ced1539f1e
SHA512 8a73b2a7d1f0916766bdf3da447c5e40b0aa8e7086144fac983fdea01014306a1a4d5abc5f521e78f8641f12ba38fd87d298d877726fbe48e1792c604a62ec2d
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0ls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3556	Unicorn-53827.exe
2336	Unicorn-63194.exe
1528	Unicorn-56650.exe
4920	Unicorn-13090.exe
2228	Unicorn-62291.exe
4252	Unicorn-38341.exe
2940	Unicorn-47801.exe
1604	Unicorn-8534.exe
1328	Unicorn-9089.exe
4456	Unicorn-16703.exe
3288	Unicorn-36608.exe
3404	Unicorn-56474.exe
1728	Unicorn-4258.exe
4556	Unicorn-51413.exe
840	Unicorn-57278.exe
1716	Unicorn-47595.exe
2172	Unicorn-6240.exe
1956	Unicorn-43319.exe
3048	Unicorn-45165.exe
2396	Unicorn-25530.exe
4696	Unicorn-57278.exe
752	Unicorn-59546.exe
208	Unicorn-56266.exe
2620	Unicorn-5092.exe
776	Unicorn-3801.exe
4204	Unicorn-11222.exe
4564	Unicorn-39488.exe
1772	Unicorn-59354.exe
1076	Unicorn-59354.exe
2080	Unicorn-51493.exe
4332	Unicorn-12758.exe
5072	Unicorn-46178.exe
4708	Unicorn-28026.exe
768	Unicorn-22964.exe
4272	Unicorn-9229.exe
2148	Unicorn-13874.exe
4192	Unicorn-50366.exe
4968	Unicorn-42463.exe
3444	Unicorn-10567.exe
2720	Unicorn-42463.exe
4716	Unicorn-50994.exe
3240	Unicorn-42825.exe
2456	Unicorn-43423.exe
860	Unicorn-17658.exe
2232	Unicorn-2945.exe
1324	Unicorn-46553.exe
3292	Unicorn-17466.exe
924	Unicorn-58414.exe
2708	Unicorn-22427.exe
2700	Unicorn-18343.exe
2864	Unicorn-18343.exe
516	Unicorn-22161.exe
3688	Unicorn-4044.exe
3720	Unicorn-10174.exe
1012	Unicorn-5898.exe
3676	Unicorn-63267.exe
4128	Unicorn-22981.exe
3748	Unicorn-27065.exe
3940	Unicorn-27065.exe
4248	Unicorn-32440.exe
2752	Unicorn-63713.exe
5048	Unicorn-51783.exe
2508	Unicorn-64590.exe
968	Unicorn-24347.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
8528	2752	WerFault.exe	149
9832	2752	WerFault.exe	149
8728	5572	WerFault.exe	196
12056	5572	WerFault.exe	196
17504	7576	WerFault.exe	313
17912	7568	WerFault.exe	312
16564	4108	WerFault.exe	789

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42789.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50315.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55203.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15956	dwm.exe
Token: SeChangeNotifyPrivilege	15956	dwm.exe
Token: 33	15956	dwm.exe
Token: SeIncBasePriorityPrivilege	15956	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe
3556	Unicorn-53827.exe
2336	Unicorn-63194.exe
1528	Unicorn-56650.exe
4920	Unicorn-13090.exe
4252	Unicorn-38341.exe
2228	Unicorn-62291.exe
2940	Unicorn-47801.exe
1604	Unicorn-8534.exe
1328	Unicorn-9089.exe
4456	Unicorn-16703.exe
3404	Unicorn-56474.exe
1728	Unicorn-4258.exe
4556	Unicorn-51413.exe
3288	Unicorn-36608.exe
840	Unicorn-57278.exe
1716	Unicorn-47595.exe
2172	Unicorn-6240.exe
1956	Unicorn-43319.exe
3048	Unicorn-45165.exe
2396	Unicorn-25530.exe
4696	Unicorn-57278.exe
752	Unicorn-59546.exe
208	Unicorn-56266.exe
776	Unicorn-3801.exe
2080	Unicorn-51493.exe
4204	Unicorn-11222.exe
1772	Unicorn-59354.exe
1076	Unicorn-59354.exe
4564	Unicorn-39488.exe
2620	Unicorn-5092.exe
4332	Unicorn-12758.exe
4272	Unicorn-9229.exe
4708	Unicorn-28026.exe
768	Unicorn-22964.exe
5072	Unicorn-46178.exe
2148	Unicorn-13874.exe
4968	Unicorn-42463.exe
4192	Unicorn-50366.exe
3240	Unicorn-42825.exe
3444	Unicorn-10567.exe
2720	Unicorn-42463.exe
4716	Unicorn-50994.exe
2232	Unicorn-2945.exe
860	Unicorn-17658.exe
2456	Unicorn-43423.exe
1324	Unicorn-46553.exe
3292	Unicorn-17466.exe
924	Unicorn-58414.exe
3676	Unicorn-63267.exe
3688	Unicorn-4044.exe
4248	Unicorn-32440.exe
516	Unicorn-22161.exe
2864	Unicorn-18343.exe
2708	Unicorn-22427.exe
3748	Unicorn-27065.exe
3940	Unicorn-27065.exe
2700	Unicorn-18343.exe
4128	Unicorn-22981.exe
3720	Unicorn-10174.exe
1012	Unicorn-5898.exe
5048	Unicorn-51783.exe
2752	Unicorn-63713.exe
2508	Unicorn-64590.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3556	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	82
PID 2184 wrote to memory of 3556	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	82
PID 2184 wrote to memory of 3556	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	82
PID 3556 wrote to memory of 2336	3556	Unicorn-53827.exe	83
PID 3556 wrote to memory of 2336	3556	Unicorn-53827.exe	83
PID 3556 wrote to memory of 2336	3556	Unicorn-53827.exe	83
PID 2184 wrote to memory of 1528	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	84
PID 2184 wrote to memory of 1528	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	84
PID 2184 wrote to memory of 1528	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	84
PID 2336 wrote to memory of 4920	2336	Unicorn-63194.exe	85
PID 2336 wrote to memory of 4920	2336	Unicorn-63194.exe	85
PID 2336 wrote to memory of 4920	2336	Unicorn-63194.exe	85
PID 1528 wrote to memory of 2228	1528	Unicorn-56650.exe	86
PID 1528 wrote to memory of 2228	1528	Unicorn-56650.exe	86
PID 1528 wrote to memory of 2228	1528	Unicorn-56650.exe	86
PID 3556 wrote to memory of 4252	3556	Unicorn-53827.exe	87
PID 3556 wrote to memory of 4252	3556	Unicorn-53827.exe	87
PID 3556 wrote to memory of 4252	3556	Unicorn-53827.exe	87
PID 2184 wrote to memory of 2940	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	88
PID 2184 wrote to memory of 2940	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	88
PID 2184 wrote to memory of 2940	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	88
PID 4920 wrote to memory of 1604	4920	Unicorn-13090.exe	93
PID 4920 wrote to memory of 1604	4920	Unicorn-13090.exe	93
PID 4920 wrote to memory of 1604	4920	Unicorn-13090.exe	93
PID 2336 wrote to memory of 1328	2336	Unicorn-63194.exe	94
PID 2336 wrote to memory of 1328	2336	Unicorn-63194.exe	94
PID 2336 wrote to memory of 1328	2336	Unicorn-63194.exe	94
PID 2228 wrote to memory of 4456	2228	Unicorn-62291.exe	95
PID 2228 wrote to memory of 4456	2228	Unicorn-62291.exe	95
PID 2228 wrote to memory of 4456	2228	Unicorn-62291.exe	95
PID 1528 wrote to memory of 3288	1528	Unicorn-56650.exe	96
PID 1528 wrote to memory of 3288	1528	Unicorn-56650.exe	96
PID 1528 wrote to memory of 3288	1528	Unicorn-56650.exe	96
PID 4252 wrote to memory of 3404	4252	Unicorn-38341.exe	97
PID 4252 wrote to memory of 3404	4252	Unicorn-38341.exe	97
PID 4252 wrote to memory of 3404	4252	Unicorn-38341.exe	97
PID 2940 wrote to memory of 1728	2940	Unicorn-47801.exe	98
PID 2940 wrote to memory of 1728	2940	Unicorn-47801.exe	98
PID 2940 wrote to memory of 1728	2940	Unicorn-47801.exe	98
PID 3556 wrote to memory of 4556	3556	Unicorn-53827.exe	99
PID 3556 wrote to memory of 4556	3556	Unicorn-53827.exe	99
PID 3556 wrote to memory of 4556	3556	Unicorn-53827.exe	99
PID 2184 wrote to memory of 840	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	100
PID 2184 wrote to memory of 840	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	100
PID 2184 wrote to memory of 840	2184	a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe	100
PID 1604 wrote to memory of 1716	1604	Unicorn-8534.exe	102
PID 1604 wrote to memory of 1716	1604	Unicorn-8534.exe	102
PID 1604 wrote to memory of 1716	1604	Unicorn-8534.exe	102
PID 4920 wrote to memory of 2172	4920	Unicorn-13090.exe	103
PID 4920 wrote to memory of 2172	4920	Unicorn-13090.exe	103
PID 4920 wrote to memory of 2172	4920	Unicorn-13090.exe	103
PID 1328 wrote to memory of 1956	1328	Unicorn-9089.exe	104
PID 1328 wrote to memory of 1956	1328	Unicorn-9089.exe	104
PID 1328 wrote to memory of 1956	1328	Unicorn-9089.exe	104
PID 2336 wrote to memory of 3048	2336	Unicorn-63194.exe	105
PID 2336 wrote to memory of 3048	2336	Unicorn-63194.exe	105
PID 2336 wrote to memory of 3048	2336	Unicorn-63194.exe	105
PID 1728 wrote to memory of 2396	1728	Unicorn-4258.exe	106
PID 1728 wrote to memory of 2396	1728	Unicorn-4258.exe	106
PID 1728 wrote to memory of 2396	1728	Unicorn-4258.exe	106
PID 2940 wrote to memory of 4696	2940	Unicorn-47801.exe	107
PID 2940 wrote to memory of 4696	2940	Unicorn-47801.exe	107
PID 2940 wrote to memory of 4696	2940	Unicorn-47801.exe	107
PID 4556 wrote to memory of 752	4556	Unicorn-51413.exe	108

C:\Users\Admin\AppData\Local\Temp\a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe
"C:\Users\Admin\AppData\Local\Temp\a6581f4cd7a97d0334271278b18614e5b97c07a75d101b510650e65ae6c59af7N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51783.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15166.exe
        9⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49671.exe
        10⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        10⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20648.exe
        10⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        10⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        9⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40837.exe
        9⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49432.exe
        9⤵
        
        PID:18424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29089.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        9⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15649.exe
        9⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47432.exe
        9⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62302.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4559.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        9⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        10⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        10⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10169.exe
        9⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        9⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58341.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        8⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        8⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34272.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        9⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        9⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11897.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47592.exe
        8⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65357.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33979.exe
        8⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60933.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38146.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3262.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        9⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10659.exe
        9⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7656.exe
        9⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28295.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14289.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35232.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39857.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17344.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39788.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30974.exe
        7⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35203.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7040.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6276.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60105.exe
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39920.exe
        7⤵
        
        PID:18336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54912.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46815.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1984.exe
        8⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12665.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53513.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        7⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30948.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        6⤵
        
        PID:11952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        6⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63713.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        9⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7568 -s 668
        9⤵
        Program crash
        
        PID:17912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 656
        8⤵
        Program crash
        
        PID:8728
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5572 -s 656
        8⤵
        Program crash
        
        PID:12056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 664
        7⤵
        Program crash
        
        PID:8528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 664
        7⤵
        Program crash
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10978.exe
        7⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        6⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        6⤵
        
        PID:18356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        6⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2914.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24695.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45529.exe
        8⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41045.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13765.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22501.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41654.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        6⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        7⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11751.exe
        6⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        7⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19821.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14184.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2692.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33335.exe
        6⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        7⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 616
        7⤵
        Program crash
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        6⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18036.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34632.exe
        5⤵
        
        PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        9⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19577.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3152.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36753.exe
        8⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 464
        9⤵
        Program crash
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33915.exe
        7⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        6⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42400.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        7⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55743.exe
        7⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
        7⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57261.exe
        6⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7818.exe
        6⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43371.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        9⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        9⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53820.exe
        9⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34429.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22124.exe
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        7⤵
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        7⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33312.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        6⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9856.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61081.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26490.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        6⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51243.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50823.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13874.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7626.exe
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21882.exe
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37419.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        9⤵
        
        PID:12108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        9⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        9⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        8⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7377.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61538.exe
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20775.exe
        7⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50263.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64609.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49649.exe
        6⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47775.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44361.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4367.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49022.exe
        5⤵
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16823.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        7⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29384.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50437.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15602.exe
        5⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49119.exe
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9157.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41837.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7988.exe
        7⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36157.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65233.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36079.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16837.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12456.exe
        6⤵
        
        PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24096.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        5⤵
        
        PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
      4⤵
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        6⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8065.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48524.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56841.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9382.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23407.exe
      4⤵
      PID:13808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41212.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50994.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        6⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        7⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55011.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4793.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35164.exe
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60854.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11760.exe
        6⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43105.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56884.exe
        6⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        6⤵
        
        PID:15264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8852.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56026.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
        7⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18176.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30567.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        6⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16453.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53947.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1408.exe
        7⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        5⤵
        
        PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13271.exe
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3400.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        5⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50315.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58009.exe
        7⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        6⤵
        
        PID:18400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61185.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36926.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        5⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33402.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25336.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        5⤵
        
        PID:13884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4288.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36848.exe
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
        5⤵
        
        PID:12876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35616.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30055.exe
      4⤵
      PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
      4⤵
      PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43423.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43802.exe
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60595.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        8⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23469.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        7⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        6⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45639.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36645.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21584.exe
        6⤵
        
        PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        6⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31095.exe
        6⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37032.exe
        5⤵
        
        PID:16028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
        6⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37422.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24195.exe
        6⤵
        
        PID:16236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49424.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37435.exe
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61677.exe
        5⤵
        
        PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12352.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44762.exe
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        5⤵
        
        PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13744.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39264.exe
        5⤵
        
        PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49361.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23153.exe
      4⤵
      PID:17260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20647.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36945.exe
        7⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37183.exe
        6⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22431.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22353.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        5⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8259.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24708.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
      4⤵
      PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20312.exe
      4⤵
      PID:16600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
      4⤵
      PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35307.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12608.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26896.exe
        5⤵
        
        PID:12860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        5⤵
        
        PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
      4⤵
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62773.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      4⤵
      PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
      4⤵
      PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61363.exe
        5⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        5⤵
        
        PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45582.exe
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8388.exe
      4⤵
      PID:13268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14376.exe
      4⤵
      PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62940.exe
      4⤵
      PID:9592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
    3⤵
    PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
      4⤵
      PID:18288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53388.exe
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
    3⤵
    PID:13904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56321.exe
    3⤵
    PID:1564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22427.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17627.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
        9⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        9⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7484.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26130.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52608.exe
        7⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40417.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58675.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32336.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        8⤵
        
        PID:18296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        7⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36350.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50713.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        6⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36075.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26771.exe
        8⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4507.exe
        7⤵
        
        PID:18412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
        6⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32763.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27907.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30362.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25912.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51517.exe
        6⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4289.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62081.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21919.exe
        8⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        7⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57101.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14113.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
        6⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4096.exe
        6⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50277.exe
        5⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55097.exe
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55600.exe
        7⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65270.exe
        5⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10365.exe
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36532.exe
        5⤵
        
        PID:11328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56861.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        5⤵
        
        PID:18312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43283.exe
        5⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31815.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9536.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58096.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
        5⤵
        
        PID:9184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        5⤵
        
        PID:13876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17884.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24596.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
      4⤵
      PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12344.exe
      4⤵
      PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34435.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-816.exe
        8⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        7⤵
        
        PID:13892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42789.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
        6⤵
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
        6⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56178.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41695.exe
        6⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        7⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26641.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2826.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60159.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22289.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18651.exe
        7⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        6⤵
        
        PID:13916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61465.exe
        6⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38513.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41480.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        5⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23827.exe
        5⤵
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37096.exe
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45971.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12162.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
        6⤵
        
        PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60138.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16524.exe
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12291.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
      4⤵
      PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
      4⤵
      PID:14852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
      4⤵
      PID:17056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9266.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        7⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13224.exe
        7⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        6⤵
        
        PID:14332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39188.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57593.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59681.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33050.exe
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
        6⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29063.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18611.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30188.exe
        6⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38949.exe
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12248.exe
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60417.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27990.exe
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17848.exe
      4⤵
      PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57837.exe
      4⤵
      PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22161.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22183.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16365.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22892.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47702.exe
      4⤵
      PID:14668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
      4⤵
      PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
    3⤵
    PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16122.exe
      4⤵
      PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17643.exe
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        5⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        5⤵
        
        PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28041.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
      4⤵
      PID:15168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
      4⤵
      PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
    3⤵
    PID:8080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
    3⤵
    PID:10492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
    3⤵
    PID:3416
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        6⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        8⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55216.exe
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21200.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45603.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55026.exe
        5⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9946.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        7⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24480.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
        6⤵
        
        PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        5⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29267.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17517.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-360.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        5⤵
        
        PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
        5⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64189.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33351.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38880.exe
        6⤵
        
        PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51274.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7289.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58078.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-964.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52478.exe
      4⤵
      PID:11828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31929.exe
      4⤵
      PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        5⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65447.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55408.exe
        7⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32762.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9027.exe
        6⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64258.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45079.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50366.exe
      4⤵
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17437.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10291.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
      4⤵
      PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43691.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34897.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33140.exe
      4⤵
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      4⤵
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        6⤵
        
        PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49666.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56520.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55793.exe
        5⤵
        
        PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10973.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24555.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51324.exe
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20381.exe
    3⤵
    PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28535.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45027.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44937.exe
        5⤵
        
        PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44897.exe
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32493.exe
      4⤵
      PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
    3⤵
    PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53439.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
      4⤵
      PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57854.exe
    3⤵
    PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-890.exe
    3⤵
    PID:13652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23335.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51659.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36785.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9332.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41124.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50854.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61273.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13432.exe
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62001.exe
      4⤵
      PID:12388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
      4⤵
      PID:17340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34819.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29879.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54962.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6207.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        5⤵
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16401.exe
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
        5⤵
        
        PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29031.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
      4⤵
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
      4⤵
      PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15751.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15751.exe
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4746.exe
      4⤵
      PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32915.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        5⤵
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39072.exe
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47777.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36961.exe
      4⤵
      PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37694.exe
    3⤵
    PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53563.exe
    3⤵
    PID:17224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17466.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1378.exe
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        5⤵
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53387.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        6⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65234.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-857.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16811.exe
        5⤵
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26240.exe
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42208.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15143.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11652.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53073.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
      4⤵
      PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
    3⤵
    PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64229.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57189.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63454.exe
      4⤵
      PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
      4⤵
      PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
    3⤵
    PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
      4⤵
      PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56316.exe
      4⤵
      PID:18232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48218.exe
    3⤵
    PID:10812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
    3⤵
    PID:14560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61921.exe
    3⤵
    PID:5468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58414.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
    3⤵
    PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33963.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35463.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62938.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        5⤵
        
        PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5701.exe
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12231.exe
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
      4⤵
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
    3⤵
    PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52183.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33856.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39648.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42353.exe
    3⤵
    PID:10868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54718.exe
    3⤵
    PID:14792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13481.exe
  2⤵
  PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
    3⤵
    PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
    3⤵
    PID:11704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
    3⤵
    PID:556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
  2⤵
  PID:8932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25272.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38832.exe
  2⤵
  PID:6372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2752 -ip 2752
1⤵
PID:7860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2752 -ip 2752
1⤵
PID:9096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5572 -ip 5572
1⤵
PID:8892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5572 -ip 5572
1⤵
PID:11944

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7576 -ip 7576
1⤵
PID:7160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7568 -ip 7568
1⤵
PID:5600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-11222.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
Size 468KB
SHA256 a0958c34f9bde9e6b6a6b68a641fd9c3337829312d89a6af35fba77e0abaeec7
MD5 cb8883ef61e40fb1764ba511bdb22a17
SHA1 31a99c8c41d0df1bf7a2e98ecdf6b671424d7d3d
SHA512 21bfda74189bbf254871b0b3e1111534e48c72bdbee8cad46bf94696a67634bde2b3f57833b549f99dbb842b2a8ae62872be7411d0c74a28080eb29b3471351f
SSDEEP 3072:bcAWog5dXB8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0lV:bc5ouir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-12758.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
Size 468KB
SHA256 b728a52d7a65476ede5209a3654d56123a3f4f01eb2b10ffeb63e9722c60d3bb
MD5 cef9a1e20060341cbfed6499ce05d6e0
SHA1 e436ea8d37f604e595c92d20f83d8274a99c4b58
SHA512 24d6d64162f418c07b4147e8318b9317b07e85c6501f324702528a23a934da1333eae149cc36902902012c0023f09052983cc31dbf9ed112b8f6ad1fdf34889d
SSDEEP 3072:bcAaog5d7B8r+7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI6E5h2j0lK:bctoCir+wPIUSx8EgDiKDIh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-13090.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-13090.exe
Size 468KB
SHA256 319dcad4aec636d1d553b1a3c6163f3adb5a5fd27e0cd446904c3647bf060eb8
MD5 e6a99cc91344f5cc44319ab2c9d4166f
SHA1 801c4240beee325b2b9d584027fc0c0c7b8c9933
SHA512 015cadfad74db4a908a925020224d0a3d87e5549ff52cb5b505af5e513d486b9819a2112a6efc25212ebcc816092f8404dae247aa82f44e20d4b68ae9aa36d00
SSDEEP 3072:bcAWog5d7B8rM7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0lK:bc5oCirMwPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-15161.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-15161.exe
Size 468KB
SHA256 158466c9f5cb8b3ff0f988e9e390d05dca56c75c5fc6cb017318487fb6f9265b
MD5 985f0caea08fcc49594ede176f978b01
SHA1 8d902a79ab821d1b746004673fdb07dd0632800d
SHA512 5d1e36f003e19ca9c096e388e2517e0afb5a6b3e012a55bc17a1c1fab44fb0bb6655f79be5ad46c1068b067f49518b3e32e8d9a8027b7232dc47229b44b8d3f9
SSDEEP 3072:wcAWog5d7B8r/7YnPzsUSx8/9Cr6x4pbvWHeZV5liKI615H2jXls:wc5oCir/oPIUSx8EVDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16703.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16703.exe
Size 468KB
SHA256 830395fd66a618dba405a2c52693d143b4b42bb1513790e5d7f135c11676f4d1
MD5 f215d6a0a10358df2f84d09444280cc1
SHA1 843b9e9af213cb575089ad1aeccabc9538b80874
SHA512 2b36a88a5800579762945161bcb37072e688c0c3fce95b7f050bfab443b21e1a1da663141e11058b548d9f87715a28556a3634048a78779d0d0ca6f2bea97313
SSDEEP 3072:bcAWog5d7B8r/7YfPzsuSx8/9Cr6x4pCvWHeZV5liKI615H2j5ls:bc5oCir/wPIuSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-25530.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-25530.exe
Size 468KB
SHA256 21edb3f76044db86c5ef131eb5d517d2a80d7aee5d45861af3753ff78179c221
MD5 e748df5d0b3ec8224db848c8f4943441
SHA1 131855aef74249b77d168f5be27fd7052f8db6f2
SHA512 004ce737c41ae1f478a27699ca22f2eb4854416b74dd746a7819b3a017fe2ce4e1325d0ab92c1be49a63734c7490f3da4294c22d63e77271c225d2f153d0b259
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeVV5liKT615H2j0lC:bc5oCir/wPIUSx8EgHiKeDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28026.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
Size 468KB
SHA256 95b2579923d1cb25c8181cc13cab23f2ed66b0c670b300229bdf56f2135d083c
MD5 ab0f5dcc136b9cf247ec7c054a74ecfc
SHA1 f75e5eaec6c96e71a88963b0211c2d50531e316e
SHA512 b71fd9b3410d4bce5c315c6dcf801dbbb2809797a9ba6a5f03a53460167083bdbb938f57194f04d8606002d78132c80029a7b348ddc79af323b310f3542fd68a
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5AiK4915h2j0lK:bc5oCir/wPIUSx8EgCiKADh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28252.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28252.exe
Size 468KB
SHA256 17435b5f2c675e3701b9e6d55e510e76bd02fc087f90820ea564fe9592ff6c08
MD5 5cc6dd8928414f1081e4f700177d49c7
SHA1 ad11bfce11b8c801925d3ee043bab164ae0e1f96
SHA512 682fca3d7d019d4b972e97c820a322f875b8479f27c553f6aeb30e04a2d61ef6917e5be58ac91690619fe8916902f1fdf3a3b1431464e9d6f356f98525021d64
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5l5KI615h2j0ls:bc5oCir/wPIUSx8EgD5KDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-36608.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-36608.exe
Size 468KB
SHA256 956fa255983df00fc21fd48d5ddc250fffda5e174e6c60fe805fd4697605475b
MD5 681679528c4180aa915da19dead0ccef
SHA1 dc9eb04d2b6d441173df523333e112b74545faf5
SHA512 df314428098e2492a25cefdff1071fde1d8afd5ef428bac5868af4cc3f92649b1b9b19a426667a8f8a0212a079903677b1457625fa6e0398cf96d6c89c99d5ee
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0lV:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-3801.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
Size 468KB
SHA256 b77c88b9347a9985bbfef38fe5cabdbaa1e92d9c82d3fee689d5ce8c71a21815
MD5 bb825e721a4bd725a9b8b923cc3a0010
SHA1 6f6adbbcea2bbdcdc16d20eac01753930228492a
SHA512 f8dd14278c167032cbe2fd336d1fae03f3dae701b7dd651e25c4380a6906397272fd7c2900376c3b24a2f6bec823e31db23b17da6d0e7c4a62518f23213231f0
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5lBKI615h2j0l7:bc5oCir/wPIUSx8EgDBKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38341.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
Size 468KB
SHA256 c32878cfcbe1b62140c0e2a294da00c1fa42e445e655d968665f12110f86101f
MD5 2560eb9c6b31add2372fb27bbe5e1344
SHA1 9197ac7df19b15294f6d60abf967aaa1bdc8f816
SHA512 9fe0a2181b95be634e47848d27f5decb8c76e3a3c514d851b079bed91aa24074d312303e859f92d2fb25ae2d3af18487a7b604b0eba20aa1ca6048454827f5b0
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0l7:bc5oCir/wPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39488.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39488.exe
Size 468KB
SHA256 c9bc4fdef7bdc5a06234077126f2248e411e2d1d4ca7b3d4e5dee70297ca1057
MD5 8b14ab9e28814828405b43543f73d2f3
SHA1 ca41b4566d2a8820c848cbeaf5c10160beb9abaa
SHA512 0ed8948cd4c8f5a76803530db9531a6364dccd7b1faab7a747bfb9712cd0adc0a56bd29bf7c9c2b050b6d41824b3bea8cd40fde6457b56103bfeefc9b3530fd6
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j5ls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4258.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
Size 468KB
SHA256 6f77277d9927a30df1ad37b194b4638ce6632b7be5e76b3a31f4f9e142efe134
MD5 d74e5f3bcdcd5e16880d2d997b514340
SHA1 0910c19dd99b1e01f3e38427554b58fc329cd7dd
SHA512 c87660c97d6a8af276622a9f134cb12119cca55f30440552b04f5f0961c6b7aa1ae6ef588650cc955591981b1243909fab6167d6d8eb865965ada8e180855c90
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKT615H2j0lC:bc5oCir/wPIUSx8EgDiKeDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-43319.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-43319.exe
Size 468KB
SHA256 9e96a83d1206246c35c417f4c68ff868061dda4e317575ab60e53e44190a69e3
MD5 d701c655653dbd84a688955ed8f4a952
SHA1 8eb7a8e06151eb1b43abdf7ac6515c4e347715ba
SHA512 08729e768687bbf5053f24db66c58d152515cff147723e2539a86114029c637aedc7a356a16f672a8e43c96b05c45c68e2107236edbc9a9f8d21fdf64aaa9104
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liK4915h2j0lK:bc5oCir/wPIUSx8EgDiKADh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45165.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
Size 468KB
SHA256 0b0367289836b0359d7b212f17c104ff1756cc9e8495f9bed6047a83a0a33afe
MD5 170050a76e46039c16e1337bb3ef4fbd
SHA1 aa425d04d914ce7a73464b3c4ffe9d66dff69fb0
SHA512 2893604a56a6f854758e805d6bfb12651d7731b9ed9741fc8bd19d19cf787f438fbb3d27d5b82f234dcc4d6911b82b26110d8d263af1e3b494da69bf0c45c23e
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liPI615h2j0lK:bc5oCir/wPIUSx8EgDiPDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-46178.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
Size 468KB
SHA256 c8240b9f688c16f86a7c8cc9303023dd1c607e08a8d67b39530b44cf3c69f473
MD5 38c6a2ad5644abb2e9624d7c92665e82
SHA1 35b570a500d4e21a5c23d8613ed68b327b879b11
SHA512 4892ca69c0a98667b19440278c1acec41ee292dc655938ec81c76b3999b42257546732b4d0a5edb916c47e2126c491fc4f5f752eae2f03847f84cc9a068b421a
SSDEEP 3072:bcAaog5d7t8rM7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0lK:bctoCGrMwPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47595.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47595.exe
Size 468KB
SHA256 c3692cf1b7625335bdaf20518b74a90a4a905b4d998fdd37422f0f27a86f1bb8
MD5 9531635f420487e6aa17506ae8d93cc2
SHA1 d32eba67fdf64f5f1661ae7b6e123afb34d30a44
SHA512 bc7cada4b02d46b1d4ccec9b5b4433f9cca7e873ad7e0e0f71aee63a9ad9bb89adfabf3cc5cc4e7f43339053729452830d4d66c69fcd37052ff02040d6a26ffa
SSDEEP 3072:bcAaog5d7B8rM7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI6E5h2j0lK:bctoCirMwPIUSx8EgDiKDIh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-47801.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47801.exe
Size 468KB
SHA256 03f921601ea44d5988c7a8abb59db91b34d569b8a184f5df4d48e10f0c0269ea
MD5 10347403d5c593a9a445e0140ef462f1
SHA1 0d9d12e71c05e62f458ef281d2321b10be0acae4
SHA512 a88507b2abfc3718f6098912e95966f641d3a1e91970d214ef6e7ed30f62abcaaf971b380ee893871bb40df835d67b98bd20db7afc12e24362bca716afeaadc7
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKT615H2j0ls:bc5oCir/wPIUSx8EgDiKeDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5092.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5092.exe
Size 468KB
SHA256 e861ca13c88375439aeb0929bafb9410a08df23e7d1b34aa284e1dad8a59d0aa
MD5 26d67c09ad8d6cf529a10f9cdfb72099
SHA1 5b0abb6521bf39e4c6dc7c12ca4ed39f869e330a
SHA512 fa8e865f7b3d9b38c53c39ac60ff6c76fe5a44a2fab6ce2082828cae690f7647ed5ad34b47da461f428d89a19f411a1fb050dad08644d909de952f6304e124f4
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0lw:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51413.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
Size 468KB
SHA256 0886543bbaeea5ac96dc38701098ba905b6f3383aa8992efd07793a0b8b7b9c4
MD5 e15f9de592148065997009b001fcd86f
SHA1 924e718191ad6d160f11dda15488a4b369d27a84
SHA512 10796dea832f8aa42bfe5f7cbbb51f5778188d22dda28a6bce7c1d79f332e0f871708c8da49314304bc1dc2e9ed64d5a00806acbde3da292ede7c43590eff837
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI6D5h2j0ls:bc5oCir/wPIUSx8EgDiKDNh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-51493.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
Size 468KB
SHA256 ed229ba99310a1ade52ce0e84460f374a8df50d58a175d8315ed24c6875bcdef
MD5 fed9ee77740f85df617e533dfe9490d7
SHA1 25388a1fe925d58ae3aff41dea0e242d9c4a1518
SHA512 d3bf018f3f59584bdff55fdaff7c80079d7f95d4d43391717e01b35487f2d398ec2f8d1d6f35a8e624341fa10c5e1c6e8f06f49b613a6da255ff7f3dff17f867
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615Hgj0ls:bc5oCir/wPIUSx8EgDiKDDHgj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53827.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53827.exe
Size 468KB
SHA256 be4deccc7f8f73fbccf56411d3bd97ac103a89aa19128081b2d8549f94d5ed44
MD5 6c121d7a2ecf2747e9cef01f6a7a7908
SHA1 0e60a4ec77c9ef28ea2f613c728116e7b20a11c3
SHA512 6d5a8a579170891744b49e7645896c61288a12a122da3e1b1e6252e47a9a8ad79a7dc2555983c10d952e436a5448844fcd718b280cbdc8b35bf7cd5429b74e24
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0ls:bc5oCir/wPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56266.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
Size 468KB
SHA256 95e5b0adc5b81723d9d87561f39ac65fd81b54576229d33cef8fca33713d1c87
MD5 d27940c404c4b07dc43866eb815563ea
SHA1 c3457c43ef2e78a82c757f768f818a2d9c58de63
SHA512 6cdfa42e3d0c5a8df428d3029ccc41ad468c58168727eb09eb674fa70595cb5e0ea2c1067f64f6388dbfb1f3c1b6a9c6b55df1aff440f23ba59afe2dc797776e
SSDEEP 3072:bcA1og5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0ls:bcSoCir/wPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56474.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
Size 468KB
SHA256 d615467c7d0291f0bdb8208d1217dc91b4cac4e55bb5d0f43017df01493eb40e
MD5 b5bd3f7c560640c3e9591b66e665049b
SHA1 6e5583f75d12b5a1ab9b09a19060ed6dbac881fd
SHA512 3df109c2ec9bf287d9b390d6e8bd54af3d1b914b49f1597d0441284cb73d004c49272a63cb32757ccb60933b4744f5eb7a35c8e5a453149d92846e3dc9d94902
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h6j0l7:bc5oCir/wPIUSx8EgDiKDDh6j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56650.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56650.exe
Size 468KB
SHA256 cb07fc9ec8157bf2a29cd64e406c4c374646c84a9a2e0ca21b3c139ccc51976b
MD5 10444b3a7c5224b19f452977f6cef7dd
SHA1 87dcede75c444f03f121976e8bf9d5fd02e701c8
SHA512 dd4b1eba9844010fe5fad83f5670a06077d2452610eb4d0ced6b2817a849c407d12f97fe8564388d3a7a6d556f331574375d44fb1c09d9d76d6eed8fdd11692c
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0ls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-57278.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
Size 468KB
SHA256 cf9584b5754451e3a56f8599b5781a3143ad02f374f847c8112449f00858d083
MD5 10bf6c2c66b91963949c75c71bfbfc7f
SHA1 308528ea2c91e482d7c396dd2d0ceec30ca3d6fc
SHA512 a714f45ad684772f45a9c44115ad7a516690cf9c3b7db5c8e4094c53ab500d0334aee17441f72975fd8271124ec91fa951c3d694786a30ae543032c44feaa712
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j0ls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59354.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59354.exe
Size 468KB
SHA256 62f24f72d247528fe5e4d8d51c59dd936a265a3a6b0928c9f3e541cbcde116f8
MD5 5b20ce0a63f9e4cec5dbfe5d9d21f800
SHA1 6de7bcf9cd5c631fd06314b57de6991c7438487f
SHA512 4a4a7ac06b59dc36ba80687cd2bc66e22dd83c5e6d479f8eaded1873f595037dfdc1bbe2ee3debb259e1dc809e8f6ebbd259af9aa34027f46ddeb8f8aded6806
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2jXls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-59546.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59546.exe
Size 468KB
SHA256 e7840313b411b78635e6aa0a0a4ccc249d08b71fb277d6894ebb1e275d2ea960
MD5 232dc317d14a6c5d168b126334dd2c50
SHA1 71cbe7285dd80a959fdf0b60c2f5b023b984fc5d
SHA512 40721b6fd2001995663439fd4d8fbea04cb14f9e19ae12971f5ffe55b5c8f0edf899ed53ad6a9f2542d26c44db27d87ebf0a5389fe0bee9995a546deb948182b
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI6D5h2juls:bc5oCir/wPIUSx8EgDiKDNh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62291.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62291.exe
Size 468KB
SHA256 af58f68f12bfd7e4e3eaba7ac6798fab3f023cdf721d699b509e48ef451735c5
MD5 c27e8f55f48a0d39f9b21609d5f728da
SHA1 26d8d2037db4c9f9cb9fc4d09b6811f05792d31f
SHA512 3b3a50feb6172c170c2cf90922650b699cb880a23bd4dd9a8414e3edcc1681a916c6c6dd0bb8b6b74d9bb7e9ad294e9deedaf346417e06db7d3cc8e313145d45
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615H2j5ls:bc5oCir/wPIUSx8EgDiKDDH2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6240.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
Size 468KB
SHA256 94eb002abf7d54f8da0b16d82836fb29f7c13cc8a2432264bb97e1f970a0f9c6
MD5 f4bfeeda3eba075e36b7ade3ff9c8484
SHA1 e6a599286b2a30b69adadb1fb1b5a231ad3779ae
SHA512 cc1cf42fbad7644e2c746ffc60250645f83a06b495b394b835def63db8d9b056f3cb539c4017121d9561f9a17eee2e9ec4e67b57321dbb5eb07d8d75aa16363b
SSDEEP 3072:bcAWog5d7B8rM7YfPzsUSx8/9Cr6x4pCvWHeZV5liwI615h2j0lK:bc5oCirMwPIUSx8EgDiwDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63194.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63194.exe
Size 468KB
SHA256 b7875a94100e9f746a3eaeef68087f223df6bcf5e4c6b6d56fcaf70bc6fdb657
MD5 c4e6c6fa29fc4f9556067966df18e09d
SHA1 5f80f69e7d5a2bfafba632650a353993b3052312
SHA512 770e3384c3f0cdcf1571833c131409a47978fc8d37abea1ce6ff9ccbe99f95a7c7a2ccdb64b14e63f7368f127ef0acc104234b66038f7c35a57661bdb824e90f
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0lK:bc5oCir/wPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-8534.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
Size 468KB
SHA256 ccd39ea172208a70e8e5c2511549f717fbeea4f07ca4cdf9bc060f64ebc85f97
MD5 f3eeb5a5d90e2caddfb47c0e5fc09830
SHA1 e019f7a0cad0273df7566c1d5d66bf9760753eb6
SHA512 7626c468b55ff55760ee483c913da27fc7aa0bb6f6b6341e50f9843fcc5eb9045d8cda58d746f65391f265138fc0426643837cb36c2143e9dd47dfff5ffcfff4
SSDEEP 3072:bcAaog5d7B8rM7YfPzsUSx8/9Cr6x4pCvWHeZV5liKI615h2j0lK:bctoCirMwPIUSx8EgDiKDDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-9089.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
Size 468KB
SHA256 a850c31c640fdb9277faba76eb9032bffb07a725223daaeaa6da8c41ccbb341a
MD5 b62b1efdd401df45b8c86f8ce09ed4bd
SHA1 7efa404390a5c199cc9d4e5c17d720256a26b880
SHA512 7442b731f94c1858af54fdffe7504c10eb03bd79a08060a5da64b8f8179074831f73c4a6cde130578e3bcd11dda0cd2df34de6b4320c5814477c3a80baa74b33
SSDEEP 3072:bcAWog5d7B8r/7YfPzsUSx8/9Cr6x4pCvWHeZV5liK4615h2j0lK:bc5oCir/wPIUSx8EgDiKTDh2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-163-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/244-1114-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/404-1117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/516-316-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/560-1118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/752-151-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/768-227-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/776-187-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/840-95-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/860-275-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/924-311-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/968-1080-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1012-323-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1072-1096-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1256-1094-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1320-1092-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1324-289-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1328-63-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1528-19-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1604-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-1085-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1716-111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1724-1101-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1728-88-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1772-190-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1832-1103-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1908-1112-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1956-126-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2080-191-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2112-1130-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2148-241-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2172-117-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2184-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2228-39-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2232-280-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2280-1121-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2292-1113-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2336-14-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2396-140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2456-274-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2508-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2620-186-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2700-315-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2708-312-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2712-1089-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2752-354-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2796-1086-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2816-1120-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2908-1081-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2940-45-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3048-133-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3172-1111-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3240-259-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3288-86-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3292-290-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3404-87-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3444-253-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3448-1105-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3556-7-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3676-319-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3688-317-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3720-318-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3748-321-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3816-1125-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4128-320-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4192-247-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4204-188-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4248-322-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4252-40-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4272-228-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4332-209-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4344-1091-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4456-85-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4496-1093-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4556-93-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4564-189-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4576-1084-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4708-226-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4716-258-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4916-1095-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4920-27-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4968-248-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5024-1128-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5036-1129-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5048-357-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5072-214-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5092-1088-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5116-1083-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5168-1131-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5176-1136-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5232-1137-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5248-1138-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5276-1139-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5304-1140-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5320-1141-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/7388-897-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/14764-2435-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads