dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe
Size

468KB
MD5

b9ee19ab7d43eae3ca82c5e8e7484731
SHA1

a81d79430069c4114eef095dd55c627b2b322d35
SHA256

dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67
SHA512

3bf77fa0418ad5fb5f9c0391289d92ed5ff7c453d29a6e25639574522628c26d6a1f1f1b954748334302c2571f36432fb9e44400c151c4091353e20017038f56
SSDEEP

3072:VPGjov7WI35vtbYZJg+5OfDVrrCdkqIpclmHeySIiGlUvsIU9SdVB:VP+o1JvtmJT5OfW0gRGlqdU9S

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2636	Unicorn-21125.exe
4564	Unicorn-33188.exe
1348	Unicorn-46187.exe
2908	Unicorn-19556.exe
4548	Unicorn-65227.exe
3636	Unicorn-35892.exe
2004	Unicorn-18578.exe
4260	Unicorn-48388.exe
620	Unicorn-34356.exe
988	Unicorn-28417.exe
804	Unicorn-34548.exe
1604	Unicorn-34548.exe
4792	Unicorn-50811.exe
32	Unicorn-31018.exe
4356	Unicorn-63307.exe
2728	Unicorn-37060.exe
4300	Unicorn-4387.exe
1012	Unicorn-63410.exe
3640	Unicorn-17002.exe
3176	Unicorn-36484.exe
4252	Unicorn-16042.exe
2456	Unicorn-3235.exe
3616	Unicorn-10619.exe
552	Unicorn-4754.exe
3484	Unicorn-5923.exe
8	Unicorn-10884.exe
2748	Unicorn-5347.exe
1120	Unicorn-51019.exe
4488	Unicorn-21684.exe
3572	Unicorn-1570.exe
1684	Unicorn-51211.exe
3084	Unicorn-20452.exe
1496	Unicorn-33450.exe
3356	Unicorn-22372.exe
3804	Unicorn-4234.exe
908	Unicorn-24100.exe
3020	Unicorn-23524.exe
1204	Unicorn-3850.exe
4620	Unicorn-56580.exe
1960	Unicorn-56315.exe
4868	Unicorn-42740.exe
4396	Unicorn-36034.exe
1272	Unicorn-22298.exe
2132	Unicorn-25444.exe
4788	Unicorn-30597.exe
1848	Unicorn-65131.exe
2948	Unicorn-24795.exe
4992	Unicorn-31028.exe
2216	Unicorn-8753.exe
3316	Unicorn-47748.exe
2464	Unicorn-47748.exe
1948	Unicorn-47748.exe
1752	Unicorn-30644.exe
3852	Unicorn-43835.exe
4708	Unicorn-29994.exe
1276	Unicorn-49860.exe
3520	Unicorn-43730.exe
3376	Unicorn-43730.exe
5028	Unicorn-30186.exe
1492	Unicorn-32948.exe
4392	Unicorn-40738.exe
1616	Unicorn-29802.exe
4944	Unicorn-52548.exe
3424	Unicorn-32874.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1444	3616	WerFault.exe	108
7820	5784	WerFault.exe	216
10788	7408	Process not Found	954

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59608.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1432	dwm.exe
Token: SeChangeNotifyPrivilege	1432	dwm.exe
Token: 33	1432	dwm.exe
Token: SeIncBasePriorityPrivilege	1432	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe
2636	Unicorn-21125.exe
4564	Unicorn-33188.exe
1348	Unicorn-46187.exe
3636	Unicorn-35892.exe
2908	Unicorn-19556.exe
4548	Unicorn-65227.exe
2004	Unicorn-18578.exe
4260	Unicorn-48388.exe
620	Unicorn-34356.exe
988	Unicorn-28417.exe
32	Unicorn-31018.exe
1604	Unicorn-34548.exe
4792	Unicorn-50811.exe
804	Unicorn-34548.exe
4356	Unicorn-63307.exe
2728	Unicorn-37060.exe
4300	Unicorn-4387.exe
1012	Unicorn-63410.exe
3640	Unicorn-17002.exe
3176	Unicorn-36484.exe
4252	Unicorn-16042.exe
2456	Unicorn-3235.exe
552	Unicorn-4754.exe
3572	Unicorn-1570.exe
1120	Unicorn-51019.exe
3484	Unicorn-5923.exe
8	Unicorn-10884.exe
1684	Unicorn-51211.exe
2748	Unicorn-5347.exe
3616	Unicorn-10619.exe
4488	Unicorn-21684.exe
3084	Unicorn-20452.exe
1496	Unicorn-33450.exe
3356	Unicorn-22372.exe
908	Unicorn-24100.exe
3804	Unicorn-4234.exe
3020	Unicorn-23524.exe
1204	Unicorn-3850.exe
1960	Unicorn-56315.exe
4620	Unicorn-56580.exe
4868	Unicorn-42740.exe
1272	Unicorn-22298.exe
4396	Unicorn-36034.exe
2132	Unicorn-25444.exe
4788	Unicorn-30597.exe
1848	Unicorn-65131.exe
2948	Unicorn-24795.exe
2216	Unicorn-8753.exe
1276	Unicorn-49860.exe
3852	Unicorn-43835.exe
1948	Unicorn-47748.exe
2464	Unicorn-47748.exe
1752	Unicorn-30644.exe
4992	Unicorn-31028.exe
3376	Unicorn-43730.exe
5028	Unicorn-30186.exe
3316	Unicorn-47748.exe
3520	Unicorn-43730.exe
1492	Unicorn-32948.exe
4708	Unicorn-29994.exe
4392	Unicorn-40738.exe
1616	Unicorn-29802.exe
4944	Unicorn-52548.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2636	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	86
PID 4984 wrote to memory of 2636	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	86
PID 4984 wrote to memory of 2636	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	86
PID 2636 wrote to memory of 4564	2636	Unicorn-21125.exe	87
PID 2636 wrote to memory of 4564	2636	Unicorn-21125.exe	87
PID 2636 wrote to memory of 4564	2636	Unicorn-21125.exe	87
PID 4984 wrote to memory of 1348	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	88
PID 4984 wrote to memory of 1348	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	88
PID 4984 wrote to memory of 1348	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	88
PID 4564 wrote to memory of 2908	4564	Unicorn-33188.exe	89
PID 4564 wrote to memory of 2908	4564	Unicorn-33188.exe	89
PID 4564 wrote to memory of 2908	4564	Unicorn-33188.exe	89
PID 2636 wrote to memory of 4548	2636	Unicorn-21125.exe	90
PID 2636 wrote to memory of 4548	2636	Unicorn-21125.exe	90
PID 2636 wrote to memory of 4548	2636	Unicorn-21125.exe	90
PID 1348 wrote to memory of 3636	1348	Unicorn-46187.exe	91
PID 1348 wrote to memory of 3636	1348	Unicorn-46187.exe	91
PID 1348 wrote to memory of 3636	1348	Unicorn-46187.exe	91
PID 4984 wrote to memory of 2004	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	92
PID 4984 wrote to memory of 2004	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	92
PID 4984 wrote to memory of 2004	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	92
PID 3636 wrote to memory of 4260	3636	Unicorn-35892.exe	93
PID 3636 wrote to memory of 4260	3636	Unicorn-35892.exe	93
PID 3636 wrote to memory of 4260	3636	Unicorn-35892.exe	93
PID 4548 wrote to memory of 620	4548	Unicorn-65227.exe	94
PID 4548 wrote to memory of 620	4548	Unicorn-65227.exe	94
PID 4548 wrote to memory of 620	4548	Unicorn-65227.exe	94
PID 2636 wrote to memory of 988	2636	Unicorn-21125.exe	96
PID 2636 wrote to memory of 988	2636	Unicorn-21125.exe	96
PID 2636 wrote to memory of 988	2636	Unicorn-21125.exe	96
PID 2004 wrote to memory of 804	2004	Unicorn-18578.exe	95
PID 2004 wrote to memory of 804	2004	Unicorn-18578.exe	95
PID 2004 wrote to memory of 804	2004	Unicorn-18578.exe	95
PID 2908 wrote to memory of 1604	2908	Unicorn-19556.exe	97
PID 2908 wrote to memory of 1604	2908	Unicorn-19556.exe	97
PID 2908 wrote to memory of 1604	2908	Unicorn-19556.exe	97
PID 4984 wrote to memory of 4792	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	99
PID 4984 wrote to memory of 4792	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	99
PID 4984 wrote to memory of 4792	4984	dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe	99
PID 1348 wrote to memory of 32	1348	Unicorn-46187.exe	98
PID 1348 wrote to memory of 32	1348	Unicorn-46187.exe	98
PID 1348 wrote to memory of 32	1348	Unicorn-46187.exe	98
PID 4564 wrote to memory of 4356	4564	Unicorn-33188.exe	100
PID 4564 wrote to memory of 4356	4564	Unicorn-33188.exe	100
PID 4564 wrote to memory of 4356	4564	Unicorn-33188.exe	100
PID 32 wrote to memory of 2728	32	Unicorn-31018.exe	101
PID 32 wrote to memory of 2728	32	Unicorn-31018.exe	101
PID 32 wrote to memory of 2728	32	Unicorn-31018.exe	101
PID 4260 wrote to memory of 4300	4260	Unicorn-48388.exe	102
PID 4260 wrote to memory of 4300	4260	Unicorn-48388.exe	102
PID 4260 wrote to memory of 4300	4260	Unicorn-48388.exe	102
PID 1348 wrote to memory of 1012	1348	Unicorn-46187.exe	103
PID 1348 wrote to memory of 1012	1348	Unicorn-46187.exe	103
PID 1348 wrote to memory of 1012	1348	Unicorn-46187.exe	103
PID 3636 wrote to memory of 3640	3636	Unicorn-35892.exe	104
PID 3636 wrote to memory of 3640	3636	Unicorn-35892.exe	104
PID 3636 wrote to memory of 3640	3636	Unicorn-35892.exe	104
PID 1604 wrote to memory of 3176	1604	Unicorn-34548.exe	105
PID 1604 wrote to memory of 3176	1604	Unicorn-34548.exe	105
PID 1604 wrote to memory of 3176	1604	Unicorn-34548.exe	105
PID 2908 wrote to memory of 4252	2908	Unicorn-19556.exe	106
PID 2908 wrote to memory of 4252	2908	Unicorn-19556.exe	106
PID 2908 wrote to memory of 4252	2908	Unicorn-19556.exe	106
PID 988 wrote to memory of 2456	988	Unicorn-28417.exe	107

C:\Users\Admin\AppData\Local\Temp\dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe
"C:\Users\Admin\AppData\Local\Temp\dcd8a54e18d5de525f673de404ef40ebe4bc6303588b6b9567d7c1956fef9a67.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23524.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        8⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6563.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        10⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52328.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        10⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9226.exe
        9⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46079.exe
        9⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        9⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        8⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59633.exe
        9⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        9⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        8⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32075.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15735.exe
        7⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6423.exe
        7⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        7⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64868.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        9⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        9⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        9⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-832.exe
        9⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46033.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65475.exe
        8⤵
        
        PID:17600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56923.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53076.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19841.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        9⤵
        
        PID:17940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47730.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6784.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21175.exe
        7⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16614.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62194.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15577.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28194.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46727.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        6⤵
        
        PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31028.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56709.exe
        8⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        8⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26209.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52491.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        8⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2297.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46436.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23921.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45416.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47745.exe
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-439.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59169.exe
        7⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        7⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53999.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3366.exe
        7⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        6⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59854.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        7⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        7⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50703.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15302.exe
        6⤵
        
        PID:18424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
        5⤵
        
        PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3747.exe
        7⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        9⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        9⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41898.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        9⤵
        
        PID:16792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44410.exe
        9⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        8⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63682.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        7⤵
        
        PID:15172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29961.exe
        7⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24631.exe
        7⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47015.exe
        7⤵
        
        PID:17896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7655.exe
        6⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2549.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43835.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52564.exe
        6⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        8⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        8⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        7⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57554.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1073.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28372.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        7⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18358.exe
        7⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27096.exe
        6⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55499.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        6⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24738.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43271.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12963.exe
        6⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55380.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27822.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29293.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        7⤵
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-734.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        6⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        7⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64394.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12080.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35218.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19073.exe
        6⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47114.exe
        6⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27867.exe
        5⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24795.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
        5⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62680.exe
        7⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        7⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        7⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52827.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58433.exe
        6⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53253.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48033.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24190.exe
        5⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48480.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38692.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51690.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
        5⤵
        
        PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        5⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        5⤵
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19731.exe
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
      4⤵
      PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38953.exe
      4⤵
      PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49860.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
        8⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        9⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25415.exe
        9⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15326.exe
        8⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60238.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20202.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47905.exe
        7⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        6⤵
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        6⤵
        
        PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30186.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18356.exe
        6⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43108.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        8⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46123.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        7⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35224.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58778.exe
        6⤵
        
        PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33937.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53297.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12889.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38663.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47015.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2282.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11150.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7255.exe
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22196.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33876.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38758.exe
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10678.exe
        7⤵
        
        PID:17552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53553.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        7⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6391.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        6⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57452.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        7⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        6⤵
        
        PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26001.exe
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        6⤵
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        5⤵
        
        PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38916.exe
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        6⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63419.exe
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37818.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14599.exe
        6⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        6⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40450.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23112.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        5⤵
        
        PID:18120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42753.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1895.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7463.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32151.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        5⤵
        
        PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      4⤵
      PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        5⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11136.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34369.exe
      4⤵
      PID:15976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
        6⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63908.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        8⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        8⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64939.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64936.exe
        7⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60955.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        7⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55426.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        6⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61415.exe
        6⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15620.exe
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38424.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52449.exe
        6⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17809.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53092.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40967.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56231.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14010.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        5⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        5⤵
        
        PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60068.exe
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        7⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34263.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        7⤵
        
        PID:18132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        6⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4734.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        6⤵
        
        PID:18476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29803.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12001.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43763.exe
        5⤵
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51042.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9696.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14880.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        5⤵
        
        PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
      4⤵
      PID:13140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7224.exe
      4⤵
      PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 640
      4⤵
      Program crash
      PID:1444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20036.exe
        5⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        6⤵
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        6⤵
        
        PID:16656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:18864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62831.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32366.exe
        5⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46522.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41970.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
      4⤵
      PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
      4⤵
      PID:16904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37290.exe
    3⤵
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
      4⤵
      PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23816.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
      4⤵
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
      4⤵
      PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10675.exe
    3⤵
    PID:7860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62992.exe
    3⤵
    PID:15276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
    3⤵
    PID:9976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        7⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        9⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        10⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63256.exe
        9⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50223.exe
        9⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        9⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        8⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3290.exe
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6407.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63038.exe
        9⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37274.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8229.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13031.exe
        7⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31914.exe
        6⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28113.exe
        9⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        9⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        8⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50668.exe
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56815.exe
        8⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30781.exe
        8⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56088.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38579.exe
        7⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21230.exe
        8⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4902.exe
        8⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        7⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
        6⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        7⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        7⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        6⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62688.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4234.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45444.exe
        6⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28740.exe
        7⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 488
        8⤵
        Program crash
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48219.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35409.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60495.exe
        8⤵
        
        PID:17128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13950.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32456.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        7⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27524.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5056.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29718.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16167.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1561.exe
        7⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61570.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35737.exe
        6⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        5⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24836.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22781.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20334.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13482.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6195.exe
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55409.exe
        7⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14150.exe
        7⤵
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        6⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31722.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        5⤵
        
        PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49399.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        5⤵
        
        PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14115.exe
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33924.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9786.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63297.exe
        9⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30256.exe
        9⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        8⤵
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40654.exe
        8⤵
        
        PID:18108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36490.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20752.exe
        7⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45548.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        6⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
        7⤵
        
        PID:18280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7351.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14162.exe
        6⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        5⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14531.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        7⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        7⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28224.exe
        6⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
        6⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65146.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56351.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35254.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
        5⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45092.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        7⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30746.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61089.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54923.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9696.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31024.exe
        6⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65487.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56523.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18999.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        6⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4142.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4016.exe
        5⤵
        
        PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27425.exe
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        5⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13360.exe
      4⤵
      PID:14812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
      4⤵
      PID:8772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:32
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37706.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41733.exe
        8⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24647.exe
        8⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8145.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
        7⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        7⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        7⤵
        
        PID:17920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        6⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        5⤵
        Executes dropped EXE
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7971.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
        8⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2681.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45025.exe
        7⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        7⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56626.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53284.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58935.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8679.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62143.exe
        7⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26277.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        5⤵
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57172.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41540.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26193.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48234.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2519.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59151.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        7⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6314.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46769.exe
        7⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10878.exe
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8615.exe
        6⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53554.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59828.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        6⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50715.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        5⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        5⤵
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29505.exe
      4⤵
      PID:3280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5667.exe
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38356.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47566.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55016.exe
        6⤵
        
        PID:13424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        5⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34257.exe
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        6⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16935.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
      4⤵
      PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
        5⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62391.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6537.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15344.exe
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64871.exe
      4⤵
      PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48526.exe
      4⤵
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28340.exe
        5⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44760.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23049.exe
        7⤵
        
        PID:18092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36459.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4350.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15543.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45195.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59759.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
        6⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32047.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40248.exe
        5⤵
        
        PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26538.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57839.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13681.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7957.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        5⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5016.exe
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43539.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32727.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3750.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17866.exe
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43087.exe
      4⤵
      PID:14028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46404.exe
      4⤵
      PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60897.exe
        5⤵
        
        PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57316.exe
        5⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55025.exe
        6⤵
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13479.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2750.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43416.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28816.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50226.exe
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      4⤵
      PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60354.exe
    3⤵
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23403.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43624.exe
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43233.exe
      4⤵
      PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9546.exe
    3⤵
    PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      4⤵
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      4⤵
      PID:17192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54132.exe
    3⤵
    PID:9252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39958.exe
    3⤵
    PID:14132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45670.exe
    3⤵
    PID:15736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11012.exe
        6⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23284.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13632.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33210.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        7⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        7⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20983.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3098.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8842.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64911.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62706.exe
        5⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34943.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64335.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        5⤵
        
        PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29994.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        5⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61777.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        5⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        6⤵
        
        PID:13804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18441.exe
        6⤵
        
        PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48801.exe
        5⤵
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5650.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31060.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28132.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15623.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35455.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48634.exe
        6⤵
        
        PID:17996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37039.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63963.exe
      4⤵
      PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29214.exe
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
      4⤵
      PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
      4⤵
      PID:8216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39300.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        7⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27414.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56344.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38975.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6246.exe
        6⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21482.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-432.exe
        6⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15193.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47423.exe
        5⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63348.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38353.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58216.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6478.exe
        5⤵
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        5⤵
        
        PID:17092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2929.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17345.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45311.exe
        5⤵
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45857.exe
        5⤵
        
        PID:18848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36860.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      4⤵
      PID:15260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43730.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21812.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18826.exe
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        5⤵
        
        PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      4⤵
      PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35208.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53400.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31616.exe
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32014.exe
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31000.exe
      4⤵
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44286.exe
      4⤵
      PID:376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6554.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20420.exe
      4⤵
      PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      4⤵
      PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      4⤵
      PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58962.exe
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
      4⤵
      PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
      4⤵
      PID:18040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
    3⤵
    PID:11328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24320.exe
    3⤵
    PID:15176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37432.exe
    3⤵
    PID:2696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55636.exe
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62772.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17348.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53288.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26990.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36239.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65016.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31888.exe
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58545.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42518.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48959.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        5⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28782.exe
        5⤵
        
        PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12318.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
      4⤵
      PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12943.exe
      4⤵
      PID:9644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52699.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15118.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        5⤵
        
        PID:15704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6720.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1025.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16894.exe
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      4⤵
      PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
      4⤵
      PID:17844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
    3⤵
    PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65412.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3511.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20791.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55311.exe
      4⤵
      PID:16020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
      4⤵
      PID:17732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52476.exe
    3⤵
    PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56168.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
      4⤵
      PID:16612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
    3⤵
    PID:9788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59608.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18960.exe
    3⤵
    PID:17028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48869.exe
    3⤵
    PID:18072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
      4⤵
      PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43732.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51940.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19566.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14286.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34155.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1486.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        5⤵
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57707.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10051.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58607.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48383.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22504.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21182.exe
      4⤵
      PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
      4⤵
      PID:7576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37306.exe
    3⤵
    PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9443.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25797.exe
        5⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1862.exe
        5⤵
        
        PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29018.exe
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17246.exe
      4⤵
      PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31663.exe
      4⤵
      PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25952.exe
      4⤵
      PID:18276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4010.exe
    3⤵
    PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14041.exe
      4⤵
      PID:18292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61519.exe
    3⤵
    PID:12212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19559.exe
    3⤵
    PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
    3⤵
    PID:8408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62932.exe
    3⤵
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20868.exe
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18742.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1294.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18410.exe
    3⤵
    PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43297.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45562.exe
      4⤵
      PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe
    3⤵
    PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19271.exe
    3⤵
    PID:13552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27257.exe
    3⤵
    PID:5964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
  2⤵
  PID:608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61236.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34337.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
      4⤵
      PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32858.exe
    3⤵
    PID:9384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7189.exe
    3⤵
    PID:12792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
    3⤵
    PID:16800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
  2⤵
  PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27744.exe
    3⤵
    PID:6192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
  2⤵
  PID:9380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64584.exe
  2⤵
  PID:13444
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
  2⤵
  PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3616 -ip 3616
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5784 -ip 5784
1⤵
PID:7660

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10619.exe

Filesize
468KB

MD5
07853fda45fb1bfbf291fb68300bf7da

SHA1
1e2d5c4c467c99f00de5c0bc053f0a74f280c929

SHA256
5be32d249f30946443499103f04090248d8765c7d26759cc5f3663afc0ba4b5d

SHA512
0898da8a0724975cf8b97952e4cd8a780ad3710255cc9370ba41b36fe1af13877d3950b4e3fcd9f35b7576f8dd29ac1456b6ffec0254e7019c6de09f993aa3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10884.exe

Filesize
468KB

MD5
c400cb6ffc0d4b568766728153c38188

SHA1
87990688fa1dc283caf3786aa073bf232c5f544a

SHA256
b0a5c5626c583592d6e103c24ee0f901f3fac5f2b8feea7bc318da6800688c9d

SHA512
1b89d09f079ea94fb5805c97f090f70a1df5126345780978fb6fd95a53e82baee064bfd6c6c4ebe6292c19afe0f892e3760d53e74ba7f4870102397784f2cb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1570.exe

Filesize
468KB

MD5
e9293daacdbe31a0b6d58c88aa0d29ce

SHA1
a1eadf4307a33df099aac7c9a3f7d7a421a7aa5e

SHA256
2d397b225a74481bd3bb18c1995f30e9a887397c1cbd9eb23974aacc2faaced5

SHA512
5b25f8ef3c50014bbe2deae9154e81103ac43a297bd091e55b8fa66d53c5af0a2c6cd441a0002a99330b5b2abe5d5a6f115f2c9fcb1fe1c34e993fb2d43de7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe

Filesize
468KB

MD5
10549df15fb1f74d68dfd34507224453

SHA1
4a12fb8a5c4ac729b7b23341eef00f34e9f7d64a

SHA256
6f3a45adac606365d310939598a574d0da4ff96dafedb3a1b7657f390e87bbae

SHA512
ba8a6b2e13bb2a679f4ee6f88e194c270f1c8f1fd65b328357507d4dc1c9f1bcf5dc895dda18e51ea23aaae1af121930bf56c78c4bc3e40d43d68c88fb5a0fae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe

Filesize
468KB

MD5
4b84e1a2317e3b35196bf2bf7efcdbfa

SHA1
3419711d76d1e96b55a302ab227d843b82b19130

SHA256
d8e02f1af9b3bdd422b44807242aad5a756f930b5ad848b38c873952c927c192

SHA512
34aff1d3e085e0f9eb02e8311545d0c8976a07769d5446063ae47c60c633b6c695c84d071646408abd82d93d7de7ffa2ac9342f033e94d9c54eff5a3dfc68fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe

Filesize
468KB

MD5
7ccfb106b1a5b84871c6e66f0b2296be

SHA1
be3ece6eb6be634f79642d18a58c22ab76027ed1

SHA256
1c3449182f1d71f63a7e8dca516353988d39a951096d1c9cab115627ce215c67

SHA512
88b2895fb5d0e681b4ac3efe6427e0c41607c8289edacb65ecc3e9bf7e193ed2bb3b10ffef26909ec8dfa136172ceb62e696870571112b38b35b18dcdb7bfb43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19556.exe

Filesize
468KB

MD5
b31e0d91dabed62b93b3c0a23b68ce4c

SHA1
d653e5eb0d520347917af5d3f99e527677f26140

SHA256
3779a5c09cc0a23db7d38cdafa02e0167a6b2dfd6c80fa2f657fa7f05014f06a

SHA512
1d67fb2769e3208aeb44fe252989b7db9dbb60e9b27174731c5375c25d5ea5c4f49541e8c1508c236c6e84493a80c0804af54c6554e64e1db69763aee4572cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe

Filesize
468KB

MD5
0ec4d853b1a54b9f703561c3b7dcd669

SHA1
0c6f4f6ccaaed8d88201bf03b8bd533edeba7f4d

SHA256
e726b11fce02b05bc6970da614dfd5d30c1750fbb6c828f3bced5188a0c26aa7

SHA512
a793754d365b2a8f9a0ef95dd32ccb097ca225d1517b69ac7ec603ad5431a2b8bb3dfb2f55bb02ed1e1924b909836a25557d79edb8867d685f28511743811099

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe

Filesize
468KB

MD5
92fe2422190750fa7c08412336998d14

SHA1
9022f774efd4ede8632c0730cb3af898803117b6

SHA256
1c1380ba8172ab7b99ecfa0449db7951ea2b39fca5bffac39531506113e22c1c

SHA512
cf6559f4f6df6b719123e5a110e458df1626a766bab30031d90792754c47f8ef602d63d309bf95f8b2d5758b045243ec3e82a5368672344a2b3fce06ccc4857f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21125.exe

Filesize
468KB

MD5
497012d8e51c3f7519bd29b9bc749f9d

SHA1
332af2d764647bf1150a7ab88d2c4deadeb38b80

SHA256
7d2de78a876dbb081c51aed8f171e1563a9f60c16ee6b322aae551aca881cd75

SHA512
9b1b768417f78ce27153b1bc1489ec601d6c3e1d0a045e130719bf3734c731e4a8757f6ecdda97b4f571b0ccd7a858a9fb690920010de0b31f2fbca3a20ba53b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21684.exe

Filesize
468KB

MD5
d8ed434d7a3c2224b014d75f57f39c2a

SHA1
10d3cd77e4bbd834c5e7461ee927e222c3a5fce9

SHA256
32f1824f1abe90b5f83a324031a02dbaed21051a2e7cb929071f2dc985d86f95

SHA512
333e307c9f4cc839f2f04fa254a16e40365a78005e545c22932e6fabc2eeb3846d392b79eebb275086b9a83da34add2fbc96a1a29514b2b359552f2ca61d7106

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24454.exe

Filesize
468KB

MD5
5c14b8fd05b1f2f827321f01c0dc739c

SHA1
8848ae1f3b37c4a111b66ed3bc71f5629e4dd4df

SHA256
7910ee2d5451b0f74c0066c3aa97bcc408ef094449a13d6e354787c80029b5f0

SHA512
6ca4ca6ce29563ee031d02a80eb64f1119d316d6092e3159fba1503146c16ade1c5828e6aa56983749f57b171ffac3e3fd63d1509a10f08fbc55b9a963ac0c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe

Filesize
468KB

MD5
fadbc9757e278be09c9eec33a9046690

SHA1
fb007f25f1a05630d391757c4b2b442b6c681e94

SHA256
275827ac0f3206441fa2a5b12c119fef226c8ba019934a968b57cc6efbf57452

SHA512
03ac3a4711eeccda2f4c3018c01c1956706db1991d8395a55f07deb5a528551b60d885b9f4dc08f0308bddfaf604a96038e4ab1cba3bfeeca85123b6c894b45e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe

Filesize
468KB

MD5
45bf99b05dfe9962ee7b71cb5908a886

SHA1
54018d187ea1ea57be9f00e695cee90b3a0100b6

SHA256
e87b3e9727ec4726ee6dc8e8eab6e478aa9fd60807e06f58657a41d95a04f495

SHA512
fb23dc01cf5eb40b39a28d9b60f55b397f7416ba38b60453a140b8d7ef6d37b2db9672f82c059400bd115ee80b565b8704b1d07e1ccb98e9be63822c4ed6c4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe

Filesize
468KB

MD5
28232124679ed84d4e0ea1260c57c8e2

SHA1
c9be5a0be8ff116f4db868c7571475eab976ae83

SHA256
d015ada0eec1dacb9e4cd9746ecf96d1fa3e45bbfb729942200e62ac3528b35f

SHA512
4d8b5fcf7bc4e460c4e0773dfa8a56dbd1ddbe4c3c611327d2e7cff539614b3593181d3055aed9e602c8efb53b909153f7e6493b121416df918c8f9aecaafb09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33188.exe

Filesize
468KB

MD5
0e08b86fe750b76e99114830401ed063

SHA1
b8cdf95e51764986af5437d5f39a9e1b871f23cc

SHA256
119dd4f266953d9c3a80889ffd583c4fca1b107521fbacbc112be5f5a2b7475d

SHA512
0491fa917f5f5896e54ad4845c1c2896cb9cb48ac1dbac9d9f348a7572d1a2d87dbc5c6cea38e45a52baf24bc94917b65badd473c31e3232940744e487623fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33450.exe

Filesize
468KB

MD5
01f841d6a0efc0f0d4a7541e9ebfd41c

SHA1
f7c86af04626145c27707b2b79f7e19454ea0805

SHA256
6a47969dd5acd1267e8aa0416d1392cffd3a371759e5aebe2ba70a6875b0820b

SHA512
b5fb854184ef547c9ebbde0ec780538bd0673a2278d64cfc8ae035a296993c7858759f9d041dde86b78fbfec35e135e5d55d4ef38502f9436a5ae04e082f8e30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34356.exe

Filesize
468KB

MD5
ce32d1682671044db9e5cd4c9c8eaad4

SHA1
65631a4a5edfd3aa5f9c2cdda53a20a305fe4bd9

SHA256
82302b96b8c3e7abbad258ed97b4e0c53e8b8bae9f6e880844839677ecdad750

SHA512
78a40d5a69cb363b74d249ff2b2640688aff0dfbbdce50fc68c378e50218953504b904d8d04c1c2dac1717b8a664b7790d4cbdd08c337c7a784930f8fd86a4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe

Filesize
468KB

MD5
d496e1268428001aef524eabcec4b2ad

SHA1
1e56a1d9d4f76bd0d9d196a4726f9d927e5ae378

SHA256
4669b4c1432a0c4e953cd30700ef0e908c66a74517ac48a627989ea6513dd4c4

SHA512
505503e5ab09a37eaac76979306b171b18cd53062584288af022851f0500fcb61fe559dbf10b4a5905efc7c15c1d8f98ca29c91afa8e439aa8e4221470802131

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35892.exe

Filesize
468KB

MD5
9c46beed00ef68b051b58063df4cfed1

SHA1
1ee81013ba114c8af35bc56e02e8cec1393938bf

SHA256
8e9431d9024027a4818c4d400b9e88d5825d4bcdf2e1f53d29d78703e31e7d80

SHA512
11e498df0d849908dabefad1462c160867ea0fb1deb74134647ec8ee5541ed40431c34949d4b14c37ee938032aa08eacb2ee5189c3329843fa88c0f10cbdb3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36484.exe

Filesize
468KB

MD5
ef88690a580e523e8d90be8c8bcbedce

SHA1
e6e2048fc47dc13bcbee297b2912a634cece3b3a

SHA256
ee043482db0b3f0924e2536c06fd6cb6139695c6babed68bd1b5214df716eb00

SHA512
ab3477e11a87907a6a16721286a8c4db244ef551868db3a436f9ba8b14399c4c4aea146a6af588eb91f3a63c5a606ce4fa92baf3dda479f94b8ef762f3163b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37060.exe

Filesize
468KB

MD5
5e8af4bcb32a107e4f788d60fa28b27d

SHA1
a5314b4b3ba743addb74eb27f9faba3df831d919

SHA256
5e91afdda6fcb685dcd6ac8b35ca6bef4c3993fc3edcbd80c3782d47eacc5923

SHA512
719718b68642535782d1c1aff73a4cc9d9c1f42d4c229467d1e4ec853d5c5a2f0671e1b68e9434fc2226398200dee012f6f8f9a09606d19f07225c2bc3bbd874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4387.exe

Filesize
468KB

MD5
3b1bc7a2abde67b6b77e34c3bd9cefd6

SHA1
7939b4b5dc8d6d065b4692999b33fa83705833e2

SHA256
f8b5f5641ca3a4f765812223c910f00d4ce4419b6c656380e33349195edb7bb4

SHA512
e2f532dd87d36f55f6c6f726ae2efe34dd0ab35c8e70ed95c7a246b2ef1c29c8daca0ed4a03cb3fc6b980629f7b3aeef8e689d4db3f83b657d2861670fd13adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46187.exe

Filesize
468KB

MD5
bc1be1f498334ca6eabf608ed77cbcf1

SHA1
206326c0e0f9821bee03c7a47f6596b003eff907

SHA256
e6fbf9f8c16027dc0e8c7f457d28261f57edd162979592178ba4206371d9bc52

SHA512
3e9528912a06bfb15dc242a2ebd5b1443d1ca0ea0807922fb07c0d47263e21ba1dc9dd1eff281d82e5f1fd658511fc7357b936730ec8dfdc4100c481d659ebe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4754.exe

Filesize
468KB

MD5
e0206d0387e9dbb02042dfd79cc4fff1

SHA1
fede8b8e7b1ba81e6583941fde4362a015cef5fe

SHA256
5612af7a06ee7cd43d4e0f3c49b608ac6ef68061891d5f54a630139b83d4e39e

SHA512
dabc14a8fb48f4dc5b406e9f23e32bd5d5d3f773dc1a420a880409d5226322558d16990ead07001e49cba50513c43dc616cfce087872eafcffeb71cc159cfd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48388.exe

Filesize
468KB

MD5
1834d8fb069d806e59fc686a0583e261

SHA1
f4e7fceeb3d82d108c288bed3cda0ea29a0c2c5c

SHA256
004b19971d0bb6f086bb391122ab34343daf9b8849e300919f4b4722e7a71dab

SHA512
599b5dcd7ba58474e1236b4d2db3bf8229a5b29e4b6d08cc4bb87b93bea49fab3155c8735c823002a150e1c920b5e7755330eebae0ae82fd357c59f4f82c845f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50811.exe

Filesize
468KB

MD5
2711d2ee6c113fb37c537b5c15b9035a

SHA1
6f167900b1f3c5d8a186a5ea1d95f73ae032ac73

SHA256
4b68deab587258a91684dd16ae3066e1a123197338f72e6ae05afcacacdd41a6

SHA512
8401aad5099a395c5b26ffc2fbfa2206530632e543b5616cee3a0412f70ce1a94e034ac67838068f254fbb68841d21110ed45c629feafe92d7890e9e55cb7c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe

Filesize
468KB

MD5
4af03dc5797610a6b730a7b540d0a2f0

SHA1
71e23ed128e67f018e85cd5db62a2ed7c3b77008

SHA256
1b2b096eec9666dbd4d3691a4e59ef5015f72045972720a67e247a3529cc3e92

SHA512
e2000482d18d7b67d979cdb10b2f578611698f4f2ef927142679bb567ef75dbb813299978c96ca7fc76f7c299bdd6aba16af78584489832cd609c24c4196d969

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51211.exe

Filesize
468KB

MD5
24e3d86e2b7943fe987813611e3b556f

SHA1
bbf38829b4893d8aa9a03d26fa973986cd2d4331

SHA256
28817a27da81ff0d0ffff2c2c06044e3c7a5c08f2723c0f88fdd99fe99130622

SHA512
96a2027d88e2804693550611f28a2619a26498fa6878c6e0797987dc381dcd9bfffbffaee8c6c42b03768e075f9f7613605cc478ea786853076101afc20924cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5347.exe

Filesize
468KB

MD5
89365153f543a6c5f45e6560a0502bd5

SHA1
d6e240fe94552ffe1c7af8562e9c16cd03476d21

SHA256
1d8317adf1792897b836016c083b6b47ee8d2143d19c8d955c95577e6fce54ee

SHA512
0d68de32cca7f0d3731ef24d535ffd5b4a5a48276139959b958cc3330cfc294ccd6dcc1c93c40537290f672d85e7d820f1d1ba1f17424d595e3d3484b16b6392

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe

Filesize
468KB

MD5
914a84752a3cee1923ea3296064f3e97

SHA1
8767be4d8d3bc8679a8b64e76edd8d34c5f78d53

SHA256
a94e482963dd5eb09e54a1df33d4408aa2b20722a4f66161f7a19ba468247f2e

SHA512
69e25faae7f60c07cea610f9bc436209cbcf4e32dddf91428bea8849e8a50c74ce60019f9a6f30ebe76986f4fe833a20d98cbbf90008f884413a14b4fdccf835

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62353.exe

Filesize
468KB

MD5
823f9bb819a28ed59e5a245d2332ff02

SHA1
825b28062278851b6dae82267f0ddf48534e06d8

SHA256
40e5cbc28d36cc1e44b322303ed70cb6b60173dec332fc27ec6727f7c916602d

SHA512
60f5e87c1c9b4777f0b09db4177b1279033e0014302fdafb4ae125ad19b0c93dd626c830c2346311e93cc7b2edfcb0d324056b6af8a902b9bbf6c9ca249d4175

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63307.exe

Filesize
468KB

MD5
22f80af92464b0f65dd9e9f556e4679c

SHA1
459a7340b703442d823ba7ec43f75ee499b57da0

SHA256
44dda843abf5f430ef54a6c25b5dc435c20ea80d4892c717fcf1686397eda741

SHA512
233572beb3dc4896699fb2e64bc3efee8416b0295117b32ca39a0a529d30ce1d1c1281b330b34bc7a2396d39e43b877115f5b2d433c7e4ecb4e3b81ce20618e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe

Filesize
468KB

MD5
a506fcc5f507947ad21d5c767f96af4a

SHA1
d9f8037ca60f50eb4872bfaf2dc97ed37bb7a9e7

SHA256
91e6fd08a06de7a16cbd1b39d01d47e6f22d4e443a242a3885691934468df746

SHA512
1833d2f0869e375b450d15c48f00dd36b67f3c29282225d4440dc43f9c4133a20e7c36273a2bd5d74c8878da6d7b3fb112631dbb482eb0b8c962bbb1703f29d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65227.exe

Filesize
468KB

MD5
93174478424e5b94955b1236c61faf15

SHA1
9675f445e752436f6810526a819df10e92001934

SHA256
86c1a34a8268b8b6eb44d5c6f04eb6e5301230616a2b49db86f2b10a8a840588

SHA512
87e518e5d16de04e705c627a8dda772667b2b82eae1864bcde69bc348c7dbeb70d1e9ad9e105af5b260938b56936a3bbdf2f61f92e33bcb569ee5c1337c2df07

Download Submit
memory/512-3648-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11080-3629-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads