d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe
Size

468KB
MD5

b1e3a4178355ab3cf2d2eb39c22afb20
SHA1

c1169da3220562e1a36d0f23f8645d3f08ecd543
SHA256

d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33
SHA512

b9998d4c4729f8db32418ac1cc0438c8e8f13412839a4a96eedc939e2b6a9df32c710fa599c3bf21a1ff1c3ed12c43752ea71b312f75d75d31c6cefaf884c1d5
SSDEEP

3072:4belogxRIU57tbYwP9cfmbfD/n2DnsIHzQmyeQVqAd5Kkki3uxulB:4b4o9c7t/PGfmbfra5wd5D73ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4804	Unicorn-31306.exe
3896	Unicorn-13641.exe
2940	Unicorn-26640.exe
5100	Unicorn-9612.exe
5000	Unicorn-12740.exe
4044	Unicorn-18871.exe
1548	Unicorn-30992.exe
1760	Unicorn-47501.exe
3672	Unicorn-2633.exe
1648	Unicorn-3245.exe
1776	Unicorn-49182.exe
3620	Unicorn-51149.exe
1324	Unicorn-3401.exe
4696	Unicorn-62808.exe
4808	Unicorn-49073.exe
4936	Unicorn-55501.exe
1376	Unicorn-10825.exe
1608	Unicorn-39013.exe
3240	Unicorn-45143.exe
2760	Unicorn-36212.exe
2076	Unicorn-25277.exe
432	Unicorn-11593.exe
3616	Unicorn-44458.exe
4460	Unicorn-44385.exe
3968	Unicorn-24784.exe
3124	Unicorn-54171.exe
4288	Unicorn-60301.exe
3396	Unicorn-54961.exe
2768	Unicorn-17203.exe
396	Unicorn-38064.exe
3208	Unicorn-52568.exe
3456	Unicorn-57271.exe
3156	Unicorn-13555.exe
752	Unicorn-1324.exe
1400	Unicorn-38085.exe
464	Unicorn-41802.exe
4408	Unicorn-57069.exe
324	Unicorn-57069.exe
3404	Unicorn-42679.exe
5056	Unicorn-24781.exe
2640	Unicorn-57645.exe
3628	Unicorn-40389.exe
2192	Unicorn-26653.exe
2448	Unicorn-58641.exe
4444	Unicorn-12896.exe
2124	Unicorn-22682.exe
724	Unicorn-20458.exe
1808	Unicorn-29389.exe
2320	Unicorn-29389.exe
2988	Unicorn-44106.exe
4060	Unicorn-44983.exe
3944	Unicorn-11433.exe
3196	Unicorn-1619.exe
4556	Unicorn-27012.exe
4368	Unicorn-25008.exe
1380	Unicorn-25885.exe
2896	Unicorn-53709.exe
3508	Unicorn-65368.exe
4676	Unicorn-21805.exe
4432	Unicorn-57797.exe
4312	Unicorn-63927.exe
980	Unicorn-46029.exe
3984	Unicorn-26355.exe
2332	Unicorn-63553.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
6740	1808	WerFault.exe	133
6700	2320	WerFault.exe	134
10532	4824	WerFault.exe	181
12284	5132	WerFault.exe	187
14392	14648	WerFault.exe	723
17380	13740	WerFault.exe	704

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18308.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44816.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5004	dwm.exe
Token: SeChangeNotifyPrivilege	5004	dwm.exe
Token: 33	5004	dwm.exe
Token: SeIncBasePriorityPrivilege	5004	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe
4804	Unicorn-31306.exe
2940	Unicorn-26640.exe
3896	Unicorn-13641.exe
5000	Unicorn-12740.exe
5100	Unicorn-9612.exe
4044	Unicorn-18871.exe
1548	Unicorn-30992.exe
1760	Unicorn-47501.exe
1776	Unicorn-49182.exe
3672	Unicorn-2633.exe
1648	Unicorn-3245.exe
1324	Unicorn-3401.exe
4696	Unicorn-62808.exe
3620	Unicorn-51149.exe
4808	Unicorn-49073.exe
4936	Unicorn-55501.exe
1376	Unicorn-10825.exe
4288	Unicorn-60301.exe
2076	Unicorn-25277.exe
2760	Unicorn-36212.exe
1608	Unicorn-39013.exe
3968	Unicorn-24784.exe
3124	Unicorn-54171.exe
4460	Unicorn-44385.exe
432	Unicorn-11593.exe
3616	Unicorn-44458.exe
3240	Unicorn-45143.exe
3396	Unicorn-54961.exe
2768	Unicorn-17203.exe
396	Unicorn-38064.exe
3208	Unicorn-52568.exe
3456	Unicorn-57271.exe
3156	Unicorn-13555.exe
752	Unicorn-1324.exe
1400	Unicorn-38085.exe
464	Unicorn-41802.exe
4408	Unicorn-57069.exe
5056	Unicorn-24781.exe
324	Unicorn-57069.exe
3404	Unicorn-42679.exe
2640	Unicorn-57645.exe
2448	Unicorn-58641.exe
3628	Unicorn-40389.exe
4444	Unicorn-12896.exe
2124	Unicorn-22682.exe
2192	Unicorn-26653.exe
3944	Unicorn-11433.exe
4368	Unicorn-25008.exe
724	Unicorn-20458.exe
4060	Unicorn-44983.exe
1808	Unicorn-29389.exe
2988	Unicorn-44106.exe
1380	Unicorn-25885.exe
3196	Unicorn-1619.exe
2320	Unicorn-29389.exe
4556	Unicorn-27012.exe
2896	Unicorn-53709.exe
3508	Unicorn-65368.exe
4676	Unicorn-21805.exe
3984	Unicorn-26355.exe
4432	Unicorn-57797.exe
2332	Unicorn-63553.exe
980	Unicorn-46029.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4804	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	86
PID 4612 wrote to memory of 4804	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	86
PID 4612 wrote to memory of 4804	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	86
PID 4804 wrote to memory of 3896	4804	Unicorn-31306.exe	87
PID 4804 wrote to memory of 3896	4804	Unicorn-31306.exe	87
PID 4804 wrote to memory of 3896	4804	Unicorn-31306.exe	87
PID 4612 wrote to memory of 2940	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	88
PID 4612 wrote to memory of 2940	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	88
PID 4612 wrote to memory of 2940	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	88
PID 2940 wrote to memory of 5100	2940	Unicorn-26640.exe	89
PID 2940 wrote to memory of 5100	2940	Unicorn-26640.exe	89
PID 2940 wrote to memory of 5100	2940	Unicorn-26640.exe	89
PID 4612 wrote to memory of 5000	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	90
PID 4612 wrote to memory of 5000	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	90
PID 4612 wrote to memory of 5000	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	90
PID 3896 wrote to memory of 4044	3896	Unicorn-13641.exe	91
PID 3896 wrote to memory of 4044	3896	Unicorn-13641.exe	91
PID 3896 wrote to memory of 4044	3896	Unicorn-13641.exe	91
PID 4804 wrote to memory of 1548	4804	Unicorn-31306.exe	92
PID 4804 wrote to memory of 1548	4804	Unicorn-31306.exe	92
PID 4804 wrote to memory of 1548	4804	Unicorn-31306.exe	92
PID 5100 wrote to memory of 1760	5100	Unicorn-9612.exe	93
PID 5100 wrote to memory of 1760	5100	Unicorn-9612.exe	93
PID 5100 wrote to memory of 1760	5100	Unicorn-9612.exe	93
PID 5000 wrote to memory of 3672	5000	Unicorn-12740.exe	94
PID 5000 wrote to memory of 3672	5000	Unicorn-12740.exe	94
PID 5000 wrote to memory of 3672	5000	Unicorn-12740.exe	94
PID 4612 wrote to memory of 1648	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	95
PID 4612 wrote to memory of 1648	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	95
PID 4612 wrote to memory of 1648	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	95
PID 2940 wrote to memory of 1776	2940	Unicorn-26640.exe	96
PID 2940 wrote to memory of 1776	2940	Unicorn-26640.exe	96
PID 2940 wrote to memory of 1776	2940	Unicorn-26640.exe	96
PID 4044 wrote to memory of 3620	4044	Unicorn-18871.exe	97
PID 4044 wrote to memory of 3620	4044	Unicorn-18871.exe	97
PID 4044 wrote to memory of 3620	4044	Unicorn-18871.exe	97
PID 1548 wrote to memory of 1324	1548	Unicorn-30992.exe	98
PID 1548 wrote to memory of 1324	1548	Unicorn-30992.exe	98
PID 1548 wrote to memory of 1324	1548	Unicorn-30992.exe	98
PID 4804 wrote to memory of 4696	4804	Unicorn-31306.exe	99
PID 4804 wrote to memory of 4696	4804	Unicorn-31306.exe	99
PID 4804 wrote to memory of 4696	4804	Unicorn-31306.exe	99
PID 3896 wrote to memory of 4808	3896	Unicorn-13641.exe	100
PID 3896 wrote to memory of 4808	3896	Unicorn-13641.exe	100
PID 3896 wrote to memory of 4808	3896	Unicorn-13641.exe	100
PID 1776 wrote to memory of 4936	1776	Unicorn-49182.exe	101
PID 1776 wrote to memory of 4936	1776	Unicorn-49182.exe	101
PID 1776 wrote to memory of 4936	1776	Unicorn-49182.exe	101
PID 1648 wrote to memory of 1376	1648	Unicorn-3245.exe	102
PID 1648 wrote to memory of 1376	1648	Unicorn-3245.exe	102
PID 1648 wrote to memory of 1376	1648	Unicorn-3245.exe	102
PID 2940 wrote to memory of 1608	2940	Unicorn-26640.exe	103
PID 2940 wrote to memory of 1608	2940	Unicorn-26640.exe	103
PID 2940 wrote to memory of 1608	2940	Unicorn-26640.exe	103
PID 4696 wrote to memory of 3240	4696	Unicorn-62808.exe	104
PID 4696 wrote to memory of 3240	4696	Unicorn-62808.exe	104
PID 4696 wrote to memory of 3240	4696	Unicorn-62808.exe	104
PID 4612 wrote to memory of 2760	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	105
PID 4612 wrote to memory of 2760	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	105
PID 4612 wrote to memory of 2760	4612	d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe	105
PID 1548 wrote to memory of 2076	1548	Unicorn-30992.exe	106
PID 1548 wrote to memory of 2076	1548	Unicorn-30992.exe	106
PID 1548 wrote to memory of 2076	1548	Unicorn-30992.exe	106
PID 4808 wrote to memory of 432	4808	Unicorn-49073.exe	107

C:\Users\Admin\AppData\Local\Temp\d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe
"C:\Users\Admin\AppData\Local\Temp\d2e5d627085dc10b1dad31fdbfab857ae1339e4245036e3af3b0b0d3912aba33N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13641.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13641.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24781.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        8⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        9⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26404.exe
        10⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34666.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4125.exe
        10⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4013.exe
        9⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        9⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        9⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        9⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        9⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        9⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27857.exe
        8⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29361.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19396.exe
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        9⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        9⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16813.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23262.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60997.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
        9⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        9⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57909.exe
        9⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37069.exe
        8⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        8⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15699.exe
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6634.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14068.exe
        9⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29165.exe
        9⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        8⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59931.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48472.exe
        6⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60586.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16420.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57550.exe
        8⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52725.exe
        8⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29965.exe
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63774.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40350.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        8⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11498.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24289.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4928.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42679.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34471.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
        9⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38474.exe
        9⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
        9⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        9⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54542.exe
        8⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51829.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32126.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20499.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60449.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7203.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22794.exe
        8⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54107.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        7⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23984.exe
        6⤵
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62497.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17818.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        7⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50187.exe
        7⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9926.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52894.exe
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        6⤵
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38989.exe
        8⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38157.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38997.exe
        7⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30900.exe
        7⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33668.exe
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21539.exe
        7⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42791.exe
        7⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57088.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        6⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        6⤵
        
        PID:1388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44514.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10425.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1325.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46061.exe
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        9⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        9⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7853.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20433.exe
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29843.exe
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12685.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43909.exe
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56724.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47508.exe
        6⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26186.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49700.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56548.exe
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54667.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22737.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55224.exe
        6⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51642.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        7⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3357.exe
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49566.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38573.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        6⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16807.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        8⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20113.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33988.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        6⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34413.exe
        5⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
        5⤵
        
        PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41453.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65141.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44461.exe
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42448.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15583.exe
        6⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
        5⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23994.exe
        6⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61291.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        6⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47961.exe
        7⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24798.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        6⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20909.exe
        5⤵
        
        PID:16580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12896.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54602.exe
        5⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38311.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6698.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54354.exe
        7⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58037.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56043.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25499.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49925.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19626.exe
      4⤵
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30243.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33546.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        5⤵
        
        PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
      4⤵
      PID:14132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39237.exe
      4⤵
      PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21805.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5033.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63940.exe
        8⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        9⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        9⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16986.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47822.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34119.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50980.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12269.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11754.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20938.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57797.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1574.exe
        8⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19647.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11473.exe
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        7⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33578.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        7⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9044.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52094.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6822.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31437.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23540.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46247.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30499.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54244.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2931.exe
        5⤵
        
        PID:13200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10972.exe
        5⤵
        
        PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        6⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40010.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32679.exe
        9⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe
        9⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        9⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        9⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
        8⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65221.exe
        7⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3475.exe
        7⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        8⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36522.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11789.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        7⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        5⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38986.exe
        7⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33201.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11951.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        6⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28900.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61938.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11098.exe
        6⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14648 -s 232
        7⤵
        Program crash
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25683.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39931.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        6⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        7⤵
        
        PID:14104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39050.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61150.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        5⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6925.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26214.exe
        5⤵
        
        PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38085.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
        5⤵
        
        PID:632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        7⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57557.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        7⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59614.exe
        6⤵
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        6⤵
        
        PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48356.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        6⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42450.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        5⤵
        
        PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38084.exe
      4⤵
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
        5⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5798.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9574.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11299.exe
        7⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28192.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
        6⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36586.exe
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30609.exe
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        5⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3286.exe
        5⤵
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26471.exe
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38381.exe
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37079.exe
      4⤵
      PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      4⤵
      PID:13440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30669.exe
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62852.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        8⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16751.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28763.exe
        7⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20452.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8218.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        6⤵
        
        PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1011.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52420.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61557.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        5⤵
        
        PID:14524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3964.exe
        5⤵
        
        PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53957.exe
      4⤵
      PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13964.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31418.exe
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44158.exe
        6⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54066.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52539.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35137.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19783.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        5⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        5⤵
        
        PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39650.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20013.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      4⤵
      PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43214.exe
      4⤵
      PID:8432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62122.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1350.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20948.exe
        8⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52043.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53074.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46661.exe
        6⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58923.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51534.exe
        6⤵
        
        PID:14296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39248.exe
        6⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
        5⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11597.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34736.exe
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29741.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31828.exe
      4⤵
      PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59837.exe
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9517.exe
        5⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42946.exe
      4⤵
      PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55118.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34020.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45860.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51342.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        6⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        5⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        5⤵
        
        PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
      4⤵
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38011.exe
      4⤵
      PID:10796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25572.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
      4⤵
      PID:6592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10115.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65077.exe
      4⤵
      PID:14248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    3⤵
    PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1433.exe
    3⤵
    PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    3⤵
    PID:14440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3548.exe
    3⤵
    PID:6948
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53709.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54509.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49479.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
        8⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
        8⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36548.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40301.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36755.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2433.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65368.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20877.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14705.exe
        8⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26427.exe
        7⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42087.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        7⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52210.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29339.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37473.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18308.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
        7⤵
        
        PID:12540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25034.exe
        7⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1578.exe
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6452.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54222.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3915.exe
        5⤵
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47175.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        7⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57227.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        6⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11805.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2950.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24458.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21946.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23460.exe
        5⤵
        
        PID:13740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13740 -s 468
        6⤵
        Program crash
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41244.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63553.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48321.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50759.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
        7⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9248.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46245.exe
        5⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        5⤵
        
        PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37130.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17844.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18163.exe
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
      4⤵
      PID:14660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57271.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63927.exe
        6⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33383.exe
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44174.exe
        9⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48242.exe
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20925.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6573.exe
        7⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        8⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        8⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16349.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18148.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        7⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
        7⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-628.exe
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58587.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        6⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37668.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        8⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        8⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        7⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64907.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56647.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18244.exe
        7⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-970.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60821.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7965.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49410.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56686.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        5⤵
        
        PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13555.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63674.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2986.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        7⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60958.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64052.exe
        5⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5876.exe
        6⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24167.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        5⤵
        
        PID:14412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-506.exe
      4⤵
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53671.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54571.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20570.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        5⤵
        
        PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        5⤵
        
        PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13657.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39351.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37828.exe
        6⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        7⤵
        
        PID:9348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 648
        6⤵
        Program crash
        
        PID:12284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 636
        5⤵
        Program crash
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20144.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25261.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        5⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46482.exe
      4⤵
      PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
      4⤵
      PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
      4⤵
      PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27012.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29988.exe
        5⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33476.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        6⤵
        
        PID:584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5505.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6669.exe
      4⤵
      PID:14200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21605.exe
      4⤵
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13241.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52647.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36788.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63447.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33403.exe
      4⤵
      PID:11220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
      4⤵
      PID:13328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59307.exe
    3⤵
    PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
      4⤵
      PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53902.exe
      4⤵
      PID:17076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
    3⤵
    PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
    3⤵
    PID:12264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20354.exe
    3⤵
    PID:16644
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        6⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50247.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        8⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24529.exe
        7⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        7⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        7⤵
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31930.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39605.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64837.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52420.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26004.exe
        6⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37717.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
        5⤵
        
        PID:14424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        5⤵
        
        PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        5⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60839.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3882.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23473.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55310.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36551.exe
        6⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21377.exe
        5⤵
        
        PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20964.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40420.exe
        6⤵
        
        PID:12168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5201.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40638.exe
        5⤵
        
        PID:16976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35035.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28385.exe
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58155.exe
      4⤵
      PID:13452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
      4⤵
      PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26295.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        7⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57805.exe
        7⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22570.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
        6⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23909.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21831.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39338.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23875.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42370.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
      4⤵
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31674.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17604.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45483.exe
        6⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62091.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51038.exe
      4⤵
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20740.exe
      4⤵
      PID:12848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1226.exe
      4⤵
      PID:13592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      4⤵
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65127.exe
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38346.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15060.exe
        5⤵
        
        PID:16064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23981.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
      4⤵
      PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57012.exe
      4⤵
      PID:15340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45796.exe
    3⤵
    PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58983.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65316.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35454.exe
      4⤵
      PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18788.exe
    3⤵
    PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
      4⤵
      PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45259.exe
      4⤵
      PID:16396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1098.exe
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
    3⤵
    PID:14244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11433.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27217.exe
        6⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50805.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56837.exe
        5⤵
        
        PID:14284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5338.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52004.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39413.exe
        5⤵
        
        PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34683.exe
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28292.exe
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28663.exe
      4⤵
      PID:16804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2374.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15491.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        6⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29226.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62496.exe
        6⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5748.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58590.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29613.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2947.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56011.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3377.exe
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62562.exe
      4⤵
      PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48099.exe
      4⤵
      PID:13492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40024.exe
    3⤵
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14777.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12810.exe
        5⤵
        
        PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20189.exe
      4⤵
      PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64635.exe
      4⤵
      PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
    3⤵
    PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
      4⤵
      PID:4964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
    3⤵
    PID:9676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18403.exe
    3⤵
    PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
    3⤵
    PID:16940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61421.exe
      4⤵
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2150.exe
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30308.exe
        6⤵
        
        PID:14704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 668
        5⤵
        Program crash
        
        PID:10532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 628
      4⤵
      Program crash
      PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54212.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16573.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26509.exe
        5⤵
        
        PID:16604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14826.exe
      4⤵
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
      4⤵
      PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
      4⤵
      PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44629.exe
    3⤵
    PID:7476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14458.exe
    3⤵
    PID:10560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50274.exe
    3⤵
    PID:13092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45375.exe
    3⤵
    PID:8288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1619.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
    3⤵
    PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22897.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
      4⤵
      PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
      4⤵
      PID:4860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5469.exe
    3⤵
    PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20545.exe
    3⤵
    PID:10780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33389.exe
    3⤵
    PID:15836
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
  2⤵
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
    3⤵
    PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
      4⤵
      PID:13904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12444.exe
      4⤵
      PID:7244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7642.exe
    3⤵
    PID:11048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12993.exe
    3⤵
    PID:14972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
  2⤵
  PID:7012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45445.exe
  2⤵
  PID:9660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
  2⤵
  PID:13356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38422.exe
  2⤵
  PID:17224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2320 -ip 2320
1⤵
PID:7696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1808 -ip 1808
1⤵
PID:7740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4824 -ip 4824
1⤵
PID:10428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5132 -ip 5132
1⤵
PID:12248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 14648 -ip 14648
1⤵
PID:13904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 13740 -ip 13740
1⤵
PID:10656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10825.exe

Filesize
468KB

MD5
8139b98de21ea109380174f86de2bc5e

SHA1
c4cbfb3fc848cd8c7275c202d7780c8272798e01

SHA256
bb9b68487c7e17adadd29b4f20b182d1b4c635714bb03f2801562967f45adf01

SHA512
db841bd204e340168060b954007152dc3f459ef2acbcab6cf118651daf914c50f0880c41ba6f33d3c167d055ba05c3d06e29fc03130d29d803dda019d171f528

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11593.exe

Filesize
468KB

MD5
61150a8fce109433daf0e72b0d8a3e34

SHA1
4b062e3df507c1df33513955e004abd3e0146def

SHA256
02baac0c8bfe8cd987d9a04ba41c493e3d2f048592d45ee9601e3988ddfc8970

SHA512
c6fc24351fafe78d868123d3d10d7d56d703fdce04c117fa9dab759a26f9b8b26fad848cec71a6971389bcc14446f85e9620ca39c976268be352dc055070245e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12740.exe

Filesize
468KB

MD5
de6a5d92e4d84ad163dba9e287144836

SHA1
835ddf8c35d0d1075212345791159d54eeeb641b

SHA256
d05f9518efd7b84dbafc60858ad670f444cc1d44876e181a1cd42f23482b5f49

SHA512
1a11097fda518ed23624ca77b5fffec9bb596c575009ddbf143d5ebfb2c3ba0fe1059d4563baa716664678d834ca6d9863ee494e1d8c58921281c88c1f149efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13641.exe

Filesize
468KB

MD5
3c351d8dd12fc596a8e7026fb2dd1d69

SHA1
0ccba24fcefc2b55fcb97de0dfec6f19ed3134b3

SHA256
a43ccd8be118654fb0c6274479e7e942b48024f05d2581c06804d70c25be1730

SHA512
1364c13623bdef94e6867f499e6f712e75d3f67a44e3cc5e691e5ab9a770079b2ffa74c72eb90ced454a6f5ecce73fc066e54ff17960dc3b874c2d576386ec48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe

Filesize
468KB

MD5
530e4bc728fe267f225414940dd73efd

SHA1
a61bc3dcb0eec95e94cbc02767ddae3cc4f2d4ca

SHA256
063787fb31c47b2e4525b3da1776c51db7d45ac4dbbae6b9d33d03b2a6295dd7

SHA512
d30f219e47488e8a6c28d8430ef2ec0a906b5626f1389b62f941b63b530f48d2689622a71c285baf90f13f2dbaa0becc4fe87025d4e4c3477b16f891bf04c54f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18871.exe

Filesize
468KB

MD5
ddb99f66df3b1f4cd227ebd30da99850

SHA1
7b20136b0a4e208bb02ed8a1199a2efa307255aa

SHA256
5c6bbd673e78c460dd260f711eb5dc678af6b08b16193a8ca83d91e5f1e726f0

SHA512
d4eac82887d01137a0f2c183fea0e8f0fed0700d870d73a72db7f982c56b32a1ce3c56b8f39a884abbd9fa1e2eb8ab5a38e91159c49d4919a2f3f5196524b670

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24784.exe

Filesize
468KB

MD5
cb3a393fb3b91690c34caa68306495c2

SHA1
5d9d6da22734f23942f09e5cfa3ae80414f28ca5

SHA256
b3d55ddd39a4458ab7d5538724e6433da5e4c111a5f3a518371ea11f129e41c3

SHA512
ad98b84bdad2cb5f6b1190297f165a7509ff284535cc51f9541df9150ed167e4e494f565b056a312119b8f1b24013ee733e82316ffb54ffcd86543428aa42796

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25277.exe

Filesize
468KB

MD5
a2494bd6b550115612b5db8d00cbcd90

SHA1
4f29003fd521bf56bad712c6300401c1f9eca246

SHA256
f9781ab531b002661cee0b4515176fc41f01d5f90482377afdeb87b5f00be7e5

SHA512
232b9371a2a96bdb4e7952f8b91839bdbf8e8468bda90e7ccfcb66724cf06225610388e6d4973db262053108d30ca235ba52f8a5bf3b38cb6af9b657fd2b986c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe

Filesize
468KB

MD5
63cdce312e5f732bf862f4b73fbc8bb8

SHA1
a0f0465a08f6f7e2c6ac8fa0f3ac63b2abec5e27

SHA256
f0ddd903c55fa0cf78601acd43f4ad7562ef3f2f7535f45d5cad6e0cf9e49852

SHA512
6007d25b5c98e5fb0b958f80d411a800a1bf594b78ad7b9ee881cae9db3f5be33439bedbbe723df3b4818a7eb2799d98b07f75aa93c433056a88902cc136be13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe

Filesize
468KB

MD5
e2baa00d7e75d562a8701ca0e36f44a7

SHA1
999cb72032aff31cd4d37dd98805c52b9b76f908

SHA256
97c3af837b1a90b34ac9fb8ecf5f22fda9a318e758adfd40e5d647f9b4dc12e1

SHA512
637b0ccb2a72bac1302854abd2845dbb02e1232634f3f6aeb322643f7a09933ad55c2e0fcde9eeaab21067499827eba343fe758327fc2912409855acdce9ac6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30992.exe

Filesize
468KB

MD5
e859094c0ab958ced2aaf868b7e8f6ce

SHA1
722dcdaac29822a5087705613d227ea74f26a6f6

SHA256
4bfefc3217c2b5d88754f137a731be21f266c123ae40f324e434baec26174c0d

SHA512
8e7c9975ad44a7027911b57eac9dce7ac95fb67c4f9f4fcd110d199b6c58b01f40c13d9966be75b4eee7d6c544a9557ae8714832443f1bb58f102f24e72ceba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe

Filesize
468KB

MD5
ca91e4bd818d0bc5d67d09fe1f11ea43

SHA1
c813149e0e7e3876024ace37cbf90adbc5c68f94

SHA256
e7ea293c4b86713854521b51d1e260e1c9fbbe7cbf9e8ce277dbc89f9818fdbd

SHA512
6707cbeec2c5f556afe8d6476395d718f546dea054f84a304d2789d587fcdb6e9790d1a71fe79dfec706ec6a58a0760f625181e82bc87fd29e3a01d8adff7749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3245.exe

Filesize
468KB

MD5
d313815285f8b01a648f6891f50b6c78

SHA1
452543b452dc7629b02b5fde0652a4826d08bb35

SHA256
0c648243e64b09a0eb301c135a7079eb37ca3953f488ca3a6ce2bf85bf8ea7c5

SHA512
3de606d374abbf8e10218c62b925261d2b84e1fc709e03614d2c59a439523649374d518b2f106b26e48fcf4659ea6ce2115603b45a323f89f602a778c74f84fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe

Filesize
468KB

MD5
8528d713867400295bbd13cdfcca5448

SHA1
bf15eb3e8df31a7acdd1bc829171ad75503dca23

SHA256
89b7e524e6ed27c0c58cfd2ee124bfea4a5d6bc348a96d5d799bda96179bb95c

SHA512
c08cc885cbd7d3d2ddda49894c03a2d24f20cbc27a7a8a699f37d2cee6c977c409d8d77380b2b0ac23cb0d9747adff49695e8fc316ca113f39f2b7bc5a1752f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36212.exe

Filesize
468KB

MD5
435c2eaef354bfecc253f4a9323903d4

SHA1
a92e5ef9af281ec0130e826200a473b41e5dc1e6

SHA256
57e1059adb2d054d95834c0ed21a4d70f7d526be7a9522a5297d0fc277009f21

SHA512
6f71f03348195aecbead5f30084b66552aa184e214ef152e4bb5cf0aee4c33e9aca3e104047b1de1c181345fed618fb296444dc97c45dd934099a96aec5f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38064.exe

Filesize
468KB

MD5
d1db9fe947fdeaffa019d86fa6a0bc5a

SHA1
c83b113d98ceb8209a8fdbdf79aaf01748ef8132

SHA256
317b6d8410971b53c1b93f10a184cc76699735e66954983b1bafc284b2e6bdd6

SHA512
ee6df5aa4ddc9a9f784ec0773d1fe20c2e2214244455206e88d89b505309412e0b3ac300e9779d78045aac673be9d070d73f6edecce2b9eb2102f5c199af7b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39013.exe

Filesize
468KB

MD5
869e6b91cd8f812fa835d6b46b814420

SHA1
70538bb3c81553f58742797ad548886d93d162e5

SHA256
45b1b95d317b6b2094edeb1bb4d79c6859266a09c1ba6664587f06513bc345ab

SHA512
eb107daac53c9d7fe81590e690fcece812c79e577aa4c2dd8f715d637bfb0ae26046da8d62c8f2fa4618bcb4a311137eca803099603058b396625826cfdced09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44385.exe

Filesize
468KB

MD5
9670a700481e241df48ecf8515d380d7

SHA1
d7911f68b5da5ea46f214bd7ecd642c5b353e4a8

SHA256
5a7d183c9544e201d167d4d7d559aa37156cb18250c49010e2d7220f41f244d6

SHA512
964cbeedd0812656f38306b1c1646243eb65d4e527fd2a88ef3f02903c95173f243f0b8c58ac03061465a6ec22bda8e4f50ed98465c704f6930aa5bd734d79a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44458.exe

Filesize
468KB

MD5
388d5602baafa9db91fb5e891a3e0d52

SHA1
70505521b634aa05830f1f115215eb6eb26f6b77

SHA256
02ee31de3acabcd2cc3089b671a55477a35a00c943a993f4f4c3f207efd4942c

SHA512
83ced385efc365d1daf6e2d59ec30bb51a0b8c5eb9754d109be0b8d6c2bfc45f3e9abde20a808ad56682a209776cbac1e180c54a338467dfb1213487c08426b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45143.exe

Filesize
468KB

MD5
3cb8f338584537b94940a324fa23ccfb

SHA1
4ade6108e68f425d330fc820e88df64496507f44

SHA256
4886ac38c5fea8e0beb1cc4437662eeebe22867cb6a510ed1323e8a5b8e7a1bf

SHA512
eefd984322c4d570120cf5f6dace4c52a7b37c5c1ec12235a58cf43cf6c544e78971edae538a7c0621ad88304fb656ca24c54048e620d08ab1b76fc71e9a62c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47501.exe

Filesize
468KB

MD5
79b798d3ac2d24257adf4f0b1d4e380f

SHA1
3a3a6be41e0a616b956a46e17c30cbd67c911b5b

SHA256
faa11956338a130776da2785d93ecf12d9a089564a060f0493518c8b9b0476df

SHA512
cf90d6c0e0dc318573fac43149d02e9b54e4c950b0f1ea21af91cd813fe55c04e66ac25961de057e64694fd022ad54b2f5876024b292b753486f323e09915e4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe

Filesize
468KB

MD5
cc8c96f3ea43200b19934a28ef6afe1d

SHA1
c79f7f98f8a128314d0f6f90645e69eb965f755b

SHA256
5b1e5f382c8c089b5d25c0eab5d730a7ded37bf40d7840cc94f541ce179536eb

SHA512
0a47713de5b6087cfd72c5071dcf3408f0c225cbdff7c024d1680fdf1adf2f541676558f52a2dec422ea671939341499cf31c9a8e25e00eda61d627fce0964ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49182.exe

Filesize
468KB

MD5
9b6430a6567decb07a8827380cec5dc8

SHA1
2b9036eb98818f41b69ff2bdffad6ce06b5eda97

SHA256
4a9761be11748d54eb38eb9c7810341b4c1f49919debe64121959b820cafd0c7

SHA512
6a80f440be366eae004c744cef653f34d260b6310eafdcc34f03d2b94db017b7451feb7677aaca05c7ab5647d163b1f43907147e41bb5d654616e00af5d320cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51149.exe

Filesize
468KB

MD5
c68a9625a8365e61d562d333bfc016de

SHA1
6577bf2dd7df891d108843c4214720926b6fb850

SHA256
2571ad94c7edbb0fc38aee84568a464bd66f6b217c900f02f2086a1b217a23c9

SHA512
477d701531bec446e9063fd903acab01ab57a7cb1c8bcc842953dad39fc66d6332b542934e14249a2effba0b5b54effa845a46aac87810736858f4b914c389f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52568.exe

Filesize
468KB

MD5
6235d9877cd61ff10dd38edb52aea572

SHA1
b7e9dc74987d9df63a7f4d7df36c55c9ce5daa94

SHA256
edf3656ceaffdf709f571f1eb3b4be92aa8d90835ccb5eb715a5f27791f5772e

SHA512
fd172355f35e1f9579d61370c7098fc4623c6140a5b3da36ac9a8e832fe99665b427851897e48b531e59759bf3bdf1cec64afc70b87a14a0b70898ee206b6863

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54171.exe

Filesize
468KB

MD5
f10416e33a90c5140d34d87737d650cd

SHA1
e0eea7fb3c9ab61d749de0af89fe2fcc6c15ea22

SHA256
2babb47965d2a4f98c1cd3d6a78003b5ca0a112112641c27d594759d3254dcc3

SHA512
9bd7ff602a48e1d80ee8a7633f53626ef9257128b4a8bba9949d4812b3ec80d812a57aaa90ba14870194ef0fccd31a338f5723a591d40d9ce52cf99d4268dc66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54961.exe

Filesize
468KB

MD5
f7de673f693d33e9b61715da35d89c95

SHA1
bb82f2dae9f6d7c1e11a3493f510fcf6aa6ea918

SHA256
bbc2506bb6f07c5c900d6abe8121ae24168dc9a5153a64d727187931f558104a

SHA512
7831231419c064d99ff3aad6381dd228ee20ce45c7ad2c541169dec17afb45e57a2e3606f87e37b25cb5b7242616b7623ad7cfd6d5dde7714e15dd62dc8783a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55501.exe

Filesize
468KB

MD5
595edd78adb7bce96c692ab6fd17f51e

SHA1
e65a50865c874982eca5353c89d21c0f953cc510

SHA256
997728183af0daa721ffa97b54d5cc9555c7756ded544a68ff4012719b202267

SHA512
40230a7103b048ef4346d36d667d23c7a11a69e6f8dc750d234926f115209cdd43ac2374c7d6ed301654d57ac33821cce3ac8ae58b5bc2f2eb67ca183665d94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58254.exe

Filesize
468KB

MD5
27bccb25bffab4593e035abfc02b0fbd

SHA1
f71253595362cbccb432435a60d318191ee52dbf

SHA256
2f683e2e50f2559ff540ba3b965b3d53aec84ff13277077639f745aa8bd2b1a8

SHA512
9231cc2142f64189d6dc0864a811b89698c8d0ff5cf0ecdefcd705749f20ef154674145912a3377c1b02d5cf6a7a14527564889e05c663345e4aab16c153a2e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60301.exe

Filesize
468KB

MD5
ccaf528431d9571ac535fdaa6b4cf6ba

SHA1
0b1ace67f9bbcca1ea3917d31e5f63edd69d4565

SHA256
3a6a45498af4c843de693b7b5302d44a2f11c5b071aaafcc9fd87ef6b9dd2667

SHA512
2770bddd5472097dd592cb72bf0c70407c077794b38a6a8bd696f20a748c599d188d5dee310bc6ee85679ba82ec3283ed6435f0b36d3ecab6dfa98d2d971ff93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62808.exe

Filesize
468KB

MD5
809a26fa2661faf61ff1fa25e185521e

SHA1
9f8344e58869be874596561c7a77adb85f3682d9

SHA256
dfe47995aae3cbf3ad1a64310da0265eea7899bc3ce05123525af1918c1048f3

SHA512
b87ead17283b7d9dda3728bb52e16e87dbbe397c2b5c861ce016a69cb4a4d3ddbc26f3a78f3a96f07649ee9a84c5069ce1df61aa734cab1e8fb83191b168b396

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe

Filesize
468KB

MD5
34b19f216235c2f5af58f49f740d134e

SHA1
ace0170b0bbd5a9b610011b5729bdb9f37c5e127

SHA256
0b03c0a8bca33064a78604fe2bff6b34559badd6d0d27f1ab888064ff68888de

SHA512
1108a3fdf524312b47aa482eb46549f41b0e6197d3945f2c5e5e0e72d1d1d5bb88d30fda6d4b32bddfc49270c61642ad5e48975213d171ae19fd3fe62c6481d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads