472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe
Size 184KB
Sample260910-tpr87ascne
SHA256 472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72
MD5 177b736a6df446238a81f3bcaa8cfc78
SHA1 fba216d81b5b9e54b8aa4b4105b14e5958db921a
SHA512 3325e24193e2a3a829845d5d0e0777d14c895648836f49dd941c87cbb4f0135bded4425b7c29898857511e76a0679756ae6a4352efbd7d80ac8436d302fd4eba
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmA3vMqgviuy:iKNob1jV1hwmA3Eqgviu
TLSH
T1A6048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5572	Unicorn-35119.exe
2460	Unicorn-28342.exe
5368	Unicorn-20728.exe
2688	Unicorn-28783.exe
1216	Unicorn-28783.exe
1676	Unicorn-62202.exe
2708	Unicorn-10400.exe
1688	Unicorn-31627.exe
4996	Unicorn-56878.exe
3796	Unicorn-47086.exe
1892	Unicorn-47086.exe
3264	Unicorn-34569.exe
448	Unicorn-28703.exe
5816	Unicorn-14968.exe
2084	Unicorn-34677.exe
4384	Unicorn-1450.exe
1700	Unicorn-2197.exe
3824	Unicorn-16910.exe
6068	Unicorn-64064.exe
2212	Unicorn-1642.exe
5644	Unicorn-1642.exe
3300	Unicorn-42675.exe
580	Unicorn-46759.exe
4984	Unicorn-22255.exe
4864	Unicorn-59209.exe
2884	Unicorn-62009.exe
5696	Unicorn-2337.exe
2720	Unicorn-48274.exe
6008	Unicorn-48274.exe
2300	Unicorn-5084.exe
4160	Unicorn-49590.exe
2552	Unicorn-52174.exe
4956	Unicorn-50166.exe
1616	Unicorn-47151.exe
2680	Unicorn-41998.exe
764	Unicorn-15033.exe
5428	Unicorn-38983.exe
6132	Unicorn-26731.exe
4028	Unicorn-30492.exe
1864	Unicorn-30492.exe
3520	Unicorn-62610.exe
4272	Unicorn-47078.exe
2716	Unicorn-47343.exe
2044	Unicorn-17686.exe
2852	Unicorn-39175.exe
4040	Unicorn-15225.exe
3452	Unicorn-15173.exe
3768	Unicorn-27691.exe
4032	Unicorn-43257.exe
2088	Unicorn-62593.exe
3568	Unicorn-7270.exe
3544	Unicorn-54640.exe
1608	Unicorn-12515.exe
4560	Unicorn-36051.exe
4620	Unicorn-11032.exe
4684	Unicorn-30898.exe
4416	Unicorn-263.exe
4664	Unicorn-31644.exe
4700	Unicorn-60747.exe
2408	Unicorn-30825.exe
4300	Unicorn-16975.exe
4232	Unicorn-57493.exe
5616	Unicorn-12013.exe
5960	Unicorn-23288.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2948	2084	WerFault.exe	102
6544	3648	WerFault.exe	196
17608	6288	WerFault.exe	835
9552	6156	WerFault.exe	827
17980	6856	WerFault.exe	838

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12439.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44913.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11385.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe
5572	Unicorn-35119.exe
2460	Unicorn-28342.exe
5368	Unicorn-20728.exe
2688	Unicorn-28783.exe
1216	Unicorn-28783.exe
1676	Unicorn-62202.exe
2708	Unicorn-10400.exe
1688	Unicorn-31627.exe
4996	Unicorn-56878.exe
5816	Unicorn-14968.exe
1892	Unicorn-47086.exe
448	Unicorn-28703.exe
3796	Unicorn-47086.exe
3264	Unicorn-34569.exe
2084	Unicorn-34677.exe
4384	Unicorn-1450.exe
1700	Unicorn-2197.exe
3824	Unicorn-16910.exe
5644	Unicorn-1642.exe
2212	Unicorn-1642.exe
580	Unicorn-46759.exe
6068	Unicorn-64064.exe
3300	Unicorn-42675.exe
4864	Unicorn-59209.exe
2884	Unicorn-62009.exe
6008	Unicorn-48274.exe
2720	Unicorn-48274.exe
5696	Unicorn-2337.exe
4984	Unicorn-22255.exe
2300	Unicorn-5084.exe
4160	Unicorn-49590.exe
2552	Unicorn-52174.exe
4956	Unicorn-50166.exe
2680	Unicorn-41998.exe
1616	Unicorn-47151.exe
764	Unicorn-15033.exe
5428	Unicorn-38983.exe
6132	Unicorn-26731.exe
4028	Unicorn-30492.exe
1864	Unicorn-30492.exe
3520	Unicorn-62610.exe
2716	Unicorn-47343.exe
2044	Unicorn-17686.exe
4272	Unicorn-47078.exe
2852	Unicorn-39175.exe
3452	Unicorn-15173.exe
3768	Unicorn-27691.exe
4040	Unicorn-15225.exe
3544	Unicorn-54640.exe
2088	Unicorn-62593.exe
3568	Unicorn-7270.exe
4416	Unicorn-263.exe
1608	Unicorn-12515.exe
4620	Unicorn-11032.exe
4684	Unicorn-30898.exe
4032	Unicorn-43257.exe
4560	Unicorn-36051.exe
4664	Unicorn-31644.exe
4700	Unicorn-60747.exe
2408	Unicorn-30825.exe
4300	Unicorn-16975.exe
4232	Unicorn-57493.exe
5960	Unicorn-23288.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5572	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	88
PID 5572 wrote to memory of 2460	5572	Unicorn-35119.exe	89
PID 4660 wrote to memory of 5368	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	90
PID 5368 wrote to memory of 2688	5368	Unicorn-20728.exe	91
PID 2460 wrote to memory of 1216	2460	Unicorn-28342.exe	92
PID 5572 wrote to memory of 1676	5572	Unicorn-35119.exe	93
PID 4660 wrote to memory of 2708	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	94
PID 2688 wrote to memory of 1688	2688	Unicorn-28783.exe	95
PID 5368 wrote to memory of 4996	5368	Unicorn-20728.exe	96
PID 2708 wrote to memory of 3796	2708	Unicorn-10400.exe	97
PID 1676 wrote to memory of 1892	1676	Unicorn-62202.exe	98
PID 4660 wrote to memory of 3264	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	99
PID 2460 wrote to memory of 5816	2460	Unicorn-28342.exe	100
PID 5572 wrote to memory of 448	5572	Unicorn-35119.exe	101
PID 1216 wrote to memory of 2084	1216	Unicorn-28783.exe	102
PID 1688 wrote to memory of 4384	1688	Unicorn-31627.exe	103
PID 2688 wrote to memory of 1700	2688	Unicorn-28783.exe	104
PID 4996 wrote to memory of 3824	4996	Unicorn-56878.exe	105
PID 5368 wrote to memory of 6068	5368	Unicorn-20728.exe	106
PID 5816 wrote to memory of 5644	5816	Unicorn-14968.exe	108
PID 1892 wrote to memory of 2212	1892	Unicorn-47086.exe	107
PID 448 wrote to memory of 3300	448	Unicorn-28703.exe	109
PID 3796 wrote to memory of 580	3796	Unicorn-47086.exe	110
PID 3264 wrote to memory of 4984	3264	Unicorn-34569.exe	111
PID 4660 wrote to memory of 4864	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	112
PID 5572 wrote to memory of 5696	5572	Unicorn-35119.exe	114
PID 2460 wrote to memory of 2884	2460	Unicorn-28342.exe	113
PID 1676 wrote to memory of 2720	1676	Unicorn-62202.exe	115
PID 2708 wrote to memory of 6008	2708	Unicorn-10400.exe	116
PID 1216 wrote to memory of 2300	1216	Unicorn-28783.exe	118
PID 4384 wrote to memory of 4160	4384	Unicorn-1450.exe	125
PID 1688 wrote to memory of 2552	1688	Unicorn-31627.exe	126
PID 2212 wrote to memory of 4956	2212	Unicorn-1642.exe	127
PID 5644 wrote to memory of 1616	5644	Unicorn-1642.exe	128
PID 3824 wrote to memory of 2680	3824	Unicorn-16910.exe	129
PID 1892 wrote to memory of 764	1892	Unicorn-47086.exe	130
PID 6068 wrote to memory of 5428	6068	Unicorn-64064.exe	131
PID 580 wrote to memory of 6132	580	Unicorn-46759.exe	132
PID 4996 wrote to memory of 1864	4996	Unicorn-56878.exe	134
PID 5816 wrote to memory of 4028	5816	Unicorn-14968.exe	133
PID 2884 wrote to memory of 3520	2884	Unicorn-62009.exe	135
PID 5368 wrote to memory of 4272	5368	Unicorn-20728.exe	136
PID 1700 wrote to memory of 2716	1700	Unicorn-2197.exe	137
PID 4864 wrote to memory of 2044	4864	Unicorn-59209.exe	138
PID 5696 wrote to memory of 2852	5696	Unicorn-2337.exe	140
PID 3796 wrote to memory of 4040	3796	Unicorn-47086.exe	139
PID 2460 wrote to memory of 3452	2460	Unicorn-28342.exe	141
PID 6008 wrote to memory of 3768	6008	Unicorn-48274.exe	142
PID 4660 wrote to memory of 4032	4660	472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe	143
PID 2688 wrote to memory of 2088	2688	Unicorn-28783.exe	144
PID 4984 wrote to memory of 3568	4984	Unicorn-22255.exe	145
PID 5572 wrote to memory of 3544	5572	Unicorn-35119.exe	146
PID 2708 wrote to memory of 1608	2708	Unicorn-10400.exe	147
PID 2720 wrote to memory of 4560	2720	Unicorn-48274.exe	148
PID 3264 wrote to memory of 4620	3264	Unicorn-34569.exe	149
PID 3300 wrote to memory of 4684	3300	Unicorn-42675.exe	150
PID 1676 wrote to memory of 4416	1676	Unicorn-62202.exe	151
PID 448 wrote to memory of 4664	448	Unicorn-28703.exe	152
PID 2300 wrote to memory of 4700	2300	Unicorn-5084.exe	153
PID 1216 wrote to memory of 2408	1216	Unicorn-28783.exe	154
PID 4160 wrote to memory of 4300	4160	Unicorn-49590.exe	156
PID 4384 wrote to memory of 4232	4384	Unicorn-1450.exe	157
PID 2552 wrote to memory of 5616	2552	Unicorn-52174.exe	158
PID 1688 wrote to memory of 5960	1688	Unicorn-31627.exe	159

C:\Users\Admin\AppData\Local\Temp\472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe
"C:\Users\Admin\AppData\Local\Temp\472bff29f55a1818a350c054bff13317f30d2e2e9cf308a9bcb25b59f895fe72.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 716
        6⤵
        Program crash
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52661.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-232.exe
        8⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37519.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53742.exe
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        7⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        6⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18597.exe
        7⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6156 -s 464
        8⤵
        Program crash
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        7⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2936.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61017.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39978.exe
        7⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 464
        8⤵
        Program crash
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22636.exe
        7⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1063.exe
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50665.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8960.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29611.exe
        5⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4785.exe
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21173.exe
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51789.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:18220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24633.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24875.exe
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51216.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5141.exe
        5⤵
        
        PID:18032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47151.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51723.exe
        7⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41613.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47183.exe
        9⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61853.exe
        9⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        9⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        9⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28696.exe
        8⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        8⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45642.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        7⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13913.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
        8⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        8⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51270.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9232.exe
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52205.exe
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38705.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        7⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17451.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        7⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        7⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19708.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        7⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52874.exe
        7⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51600.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41777.exe
        6⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        6⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28179.exe
        6⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59751.exe
        7⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61106.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60537.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
        8⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8111.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45649.exe
        8⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11749.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        7⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        7⤵
        
        PID:17848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18972.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7385.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        7⤵
        
        PID:15380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        7⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        7⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        6⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9762.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        5⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3316.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
        6⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49674.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        6⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59590.exe
        5⤵
        
        PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41268.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
        5⤵
        
        PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62610.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3726.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63130.exe
        8⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        8⤵
        
        PID:316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25223.exe
        8⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11508.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38452.exe
        7⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18944.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
        6⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63150.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47252.exe
        6⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        6⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54557.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46500.exe
        6⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        6⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63246.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        5⤵
        
        PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9294.exe
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        6⤵
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25561.exe
        6⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        5⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        5⤵
        
        PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45865.exe
      4⤵
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26571.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        5⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51500.exe
        5⤵
        
        PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8606.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28975.exe
      4⤵
      PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42776.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61305.exe
      4⤵
      PID:7040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        9⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        9⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        9⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44406.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        8⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-560.exe
        8⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64082.exe
        8⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59730.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        8⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3353.exe
        8⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        8⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59625.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63232.exe
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30577.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30572.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47008.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52995.exe
        7⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32559.exe
        7⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21423.exe
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        8⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19500.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19600.exe
        8⤵
        
        PID:18140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6580.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1796.exe
        7⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14445.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33063.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2068.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        7⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-204.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10654.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        6⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15033.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6726.exe
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15221.exe
        8⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39048.exe
        8⤵
        
        PID:472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30804.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18384.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
        7⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 468
        8⤵
        Program crash
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17201.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40736.exe
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32863.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30058.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35951.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17408.exe
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        6⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29147.exe
        5⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
        6⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        6⤵
        
        PID:16196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
        6⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6284.exe
        5⤵
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3026.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39385.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49205.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        5⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-800.exe
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48433.exe
        5⤵
        
        PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36051.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45174.exe
        6⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59762.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18975.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        8⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56762.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30907.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        7⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11468.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27481.exe
        7⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47861.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20781.exe
        6⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27671.exe
        6⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14661.exe
        6⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        6⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        5⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63290.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25595.exe
        5⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
        5⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59756.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31004.exe
        5⤵
        
        PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-263.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        5⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51380.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        5⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40183.exe
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33078.exe
        5⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24468.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16324.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        5⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        5⤵
        
        PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      4⤵
      PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57270.exe
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19670.exe
      4⤵
      PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59844.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35205.exe
      4⤵
      PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
      4⤵
      PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30898.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        6⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6150.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        7⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58141.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        6⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55542.exe
        5⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11033.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8125.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26891.exe
        6⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30131.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41201.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
        5⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4708.exe
        5⤵
        
        PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37198.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61775.exe
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61245.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27140.exe
        6⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-301.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46498.exe
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15192.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23197.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        5⤵
        
        PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48665.exe
      4⤵
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        5⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57326.exe
        5⤵
        
        PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
      4⤵
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      4⤵
      PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
      4⤵
      PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42761.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39175.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19570.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2066.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        7⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42822.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44372.exe
        6⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30603.exe
        6⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37664.exe
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17988.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
        5⤵
        
        PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28994.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19072.exe
      4⤵
      PID:17764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54640.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        5⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52761.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52480.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        5⤵
        
        PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7061.exe
        5⤵
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8646.exe
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17623.exe
        5⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        5⤵
        
        PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
      4⤵
      PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35624.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13236.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28164.exe
      4⤵
      PID:9752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
    3⤵
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      4⤵
      PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34353.exe
      4⤵
      PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14840.exe
      4⤵
      PID:10496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33339.exe
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
    3⤵
    PID:9636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
    3⤵
    PID:12800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2929.exe
    3⤵
    PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
    3⤵
    PID:3816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16975.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        9⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52865.exe
        9⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54421.exe
        9⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12240.exe
        9⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51152.exe
        9⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21873.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        8⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        8⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40332.exe
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10688.exe
        8⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6968.exe
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9362.exe
        8⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7769.exe
        8⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2755.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1235.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43010.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8268.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38484.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        7⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exe
        7⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57493.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42543.exe
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8786.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42485.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25064.exe
        7⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        7⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32411.exe
        6⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62066.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26569.exe
        7⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15703.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-485.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26819.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8184.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16728.exe
        6⤵
        
        PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12013.exe
        6⤵
        Executes dropped EXE
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
        8⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56285.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14815.exe
        8⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        8⤵
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17155.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9424.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13713.exe
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33478.exe
        7⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        7⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25193.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39793.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54060.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
        6⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46710.exe
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12377.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        7⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65277.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10856.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30233.exe
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10876.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38797.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58889.exe
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2865.exe
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24052.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2889.exe
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        6⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41169.exe
        5⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14465.exe
        5⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56551.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37784.exe
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21585.exe
        5⤵
        
        PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        6⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28999.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61441.exe
        7⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        6⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48853.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51852.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1520.exe
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40153.exe
        6⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8641.exe
        6⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43374.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        6⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        6⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        6⤵
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61801.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23504.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41948.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14272.exe
        5⤵
        
        PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        5⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7317.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3144.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8384.exe
        5⤵
        
        PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57545.exe
      4⤵
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29890.exe
        5⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42673.exe
        5⤵
        
        PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53421.exe
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57078.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10625.exe
      4⤵
      PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28651.exe
      4⤵
      PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5164.exe
      4⤵
      PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16017.exe
      4⤵
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23881.exe
      4⤵
      PID:17848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        6⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27271.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32931.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
        7⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14964.exe
        7⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60587.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        7⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        7⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        7⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3332.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14201.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42627.exe
        6⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        5⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37946.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21249.exe
        7⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        7⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30987.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
        5⤵
        
        PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23026.exe
        5⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        6⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51997.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37207.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35576.exe
        6⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36377.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52886.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60316.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44540.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        5⤵
        
        PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2204.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60327.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48527.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15420.exe
        6⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64586.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60265.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
      4⤵
      PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7396.exe
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26923.exe
      4⤵
      PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
      4⤵
      PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38983.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41007.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26031.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9889.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58277.exe
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22328.exe
        6⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27737.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62507.exe
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31064.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        6⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44068.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        5⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        5⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        5⤵
        
        PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14318.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50286.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37548.exe
        5⤵
        
        PID:14884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30762.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63098.exe
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4105.exe
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34920.exe
      4⤵
      PID:16672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8334.exe
      4⤵
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        6⤵
        
        PID:12624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        6⤵
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46844.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27401.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40537.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60206.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        5⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18987.exe
      4⤵
      PID:15016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30449.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15631.exe
    3⤵
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42035.exe
      4⤵
      PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53025.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39646.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63565.exe
      4⤵
      PID:18056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58471.exe
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9997.exe
    3⤵
    PID:15856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35266.exe
    3⤵
    PID:8536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33223.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35479.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        7⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40565.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        7⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26048.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        6⤵
        
        PID:16644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35803.exe
        6⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47155.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22012.exe
        7⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36725.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3772.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53854.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8348.exe
        6⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53725.exe
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20043.exe
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52722.exe
        5⤵
        
        PID:15108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12501.exe
        5⤵
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16352.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6357.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41127.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16565.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40165.exe
        6⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-959.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65177.exe
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39394.exe
        5⤵
        
        PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51680.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
        5⤵
        
        PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3161.exe
        5⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27864.exe
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35806.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
      4⤵
      PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
      4⤵
      PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39196.exe
      4⤵
      PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19053.exe
      4⤵
      PID:8556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50255.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44277.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        7⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58381.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42577.exe
        7⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4629.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54400.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44913.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64686.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40634.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
        6⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17621.exe
        5⤵
        
        PID:16540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22677.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50867.exe
        5⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16735.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        5⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3065.exe
        5⤵
        
        PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35609.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16741.exe
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
      4⤵
      PID:13784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
      4⤵
      PID:18212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12515.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35854.exe
      4⤵
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63004.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55433.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65525.exe
        5⤵
        
        PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32205.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52139.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19637.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62945.exe
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2843.exe
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
      4⤵
      PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
      4⤵
      PID:16444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62506.exe
    3⤵
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38283.exe
      4⤵
      PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41188.exe
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50922.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47924.exe
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23584.exe
      4⤵
      PID:11156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
    3⤵
    PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
    3⤵
    PID:9340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
    3⤵
    PID:12044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
    3⤵
    PID:14552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63161.exe
    3⤵
    PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46385.exe
    3⤵
    PID:18180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        5⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61910.exe
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8380.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        5⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60291.exe
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14059.exe
        5⤵
        
        PID:18168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
      4⤵
      PID:3648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 636
        5⤵
        Program crash
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46408.exe
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16343.exe
      4⤵
      PID:12308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60727.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11032.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58283.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12569.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30687.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
        5⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37384.exe
        5⤵
        
        PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39584.exe
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6928.exe
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
      4⤵
      PID:13108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8529.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27754.exe
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16960.exe
      4⤵
      PID:11068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61109.exe
    3⤵
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45818.exe
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15967.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
      4⤵
      PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52465.exe
      4⤵
      PID:18204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41474.exe
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
    3⤵
    PID:9272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
    3⤵
    PID:12740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27136.exe
    3⤵
    PID:17352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54904.exe
    3⤵
    PID:17948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
    3⤵
    PID:10988
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4141.exe
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42030.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19668.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61284.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4996.exe
        6⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        6⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20056.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
        5⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35889.exe
        5⤵
        
        PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1992.exe
      4⤵
      PID:15008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61586.exe
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14889.exe
      4⤵
      PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
    3⤵
    PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
      4⤵
      PID:2612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13095.exe
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39402.exe
      4⤵
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56221.exe
    3⤵
    PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4843.exe
    3⤵
    PID:10832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
    3⤵
    PID:13880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19258.exe
    3⤵
    PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23296.exe
    3⤵
    PID:17612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21739.exe
    3⤵
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26165.exe
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26304.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
      4⤵
      PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      4⤵
      PID:17264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
    3⤵
    PID:9968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25009.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12620.exe
    3⤵
    PID:14908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10605.exe
    3⤵
    PID:16792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34143.exe
  2⤵
  PID:1960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14126.exe
    3⤵
    PID:8420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58262.exe
    3⤵
    PID:11676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16359.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32625.exe
    3⤵
    PID:6888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14359.exe
    3⤵
    PID:17832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
  2⤵
  PID:7116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47277.exe
  2⤵
  PID:9828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29485.exe
  2⤵
  PID:12892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40730.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40730.exe
  2⤵
  PID:15828
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20713.exe
  2⤵
  PID:16688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2084 -ip 2084
1⤵
PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3648 -ip 3648
1⤵
PID:6684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-10400.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-10400.exe
Size 184KB
SHA256 dd52ef59b6d132992166a7f571cf717b722bae8621b7a931fb8112b0690f685b
MD5 6ec8065657a3ba2e735789e436c5821b
SHA1 29d1b82165faae103b6317ecc774c4c7163bccbf
SHA512 f94925eb6b5fab2662b719ab41d235a047393f011054a7e3d8d87c596ad9b87c323146e52bfe98b99e8e8b92532a0dcfefb70031a0137ef5fe18490614e54735
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmA3vMqgvium:iKNob1jV1hwmA3Eqgviu
TLSH
T16D048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1450.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1450.exe
Size 184KB
SHA256 8d7555629170c697076f00bdfbb2d9227b39247b02818ca31d505b38abe5a3d3
MD5 de77669d7dc8c077803a199bba4ab09d
SHA1 8b5e9e6969a2a0fd5b3cb6e216f36ed7da502297
SHA512 dfb4c594c27127545895dc50b5ce12a72f0d8097a26d2e7276e04e13f7152ca975b65afcf0bb182f6b7cd1bc06b428d6bb8dea8498b8dd1cc4ba78c0068aebe9
SSDEEP 3072:iK1y5AoKPUPdjVFXBkh+Wm23vMqgviuO:iKNob1jV4h1m23Eqgviu
TLSH
T1F6048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-14968.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
Size 184KB
SHA256 9e363f8d99fd3572d55d13829cb9e761c8c28162b08fce62a306f334b5bf7f5b
MD5 83389567f8db9c4e547e1afe8f632c37
SHA1 0c02f6e734d7bbb171bace928ebf9b73429ad6d4
SHA512 ad73cf9435b179efb605b79ba62c270ecbefa619b7ed09ad4592283ba1e15d3a5a432192b7f04b726339b9dfabec1360780251b0c104a66ef3af24861fc9d484
SSDEEP 3072:iK1y5AoKPUPdjVFXPkhNWmU3vMqgviuy:iKNob1jVKhwmU3Eqgviu
TLSH
T1C4048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-1642.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
Size 184KB
SHA256 6c509f5af719e6c834d782755c8e34440b101fb15c26a00139c14d1cdcbb7e3b
MD5 b73593239317605e7c7334501357e4db
SHA1 161b0547e3281f36fc8b870e887b252601446d4b
SHA512 6212fd7a0352c4d7d40787b5aee4aa6b9797dbbe3218d02ca7d66027e37de8bcc37b7934498d14972eda9b339aa5ca99fa43fcc6877a7993488521414285721a
SSDEEP 3072:iK1y5AoKPUPdjVFXPkhNWmU3vMqgviuv:iKNob1jVKhwmU3Eqgviu
TLSH
T1C3048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-16910.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
Size 184KB
SHA256 25f5310eb7e4b78b0765f21fdd7a217cd9306e627df0872196dcd3fb3931985f
MD5 d6570159facfaf7c95d0aeb72d378f66
SHA1 811e684259fb4220c52168d1e6af3cd4a50b12fd
SHA512 f22219152ebcca5c08354ffc6abc7fe4552e934264ccd05026161623e1f981fdf91db2286a699823eb3d619b84d6b1542747ee95bdc00231306a69f3f58553d8
SSDEEP 3072:iK1y5AoKKUKdjVFXmkhNWmZ3vMqgviuy:iKNoGGjV1hwmZ3Eqgviu
TLSH
T14C048F628970BB13E952093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-20728.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-20728.exe
Size 184KB
SHA256 b87f2c63f738053e77e8f83cfb51fdee7728aa4f85a17241834c61f0d731401e
MD5 aea84edc0dcf918cc5ac2e6cf35e1473
SHA1 ccd6bb50e2b1e568428847cb4ce404f4591a5a55
SHA512 e963bc80325485057be0f1247a23956cdcd7333769c31eb2065a0f889c01a2efc31db5bb23656dbab4b0047a617d71d887ea250e2ca9f599bf5f9572f41f7d6b
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmZ3vMqgviuy:iKNob1jV1hwmZ3Eqgviu
TLSH
T160048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2197.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2197.exe
Size 184KB
SHA256 394252fce1c9debdf9a3aac5c25453fd28e2f20764139e3e16ea7905598a1bc9
MD5 c9c9a8785c6110f7f92a67fed977c212
SHA1 47e29dfae4a39963ef625f824bffe863998cc1b0
SHA512 6f955a84c2780172b65ce0167fdee618d0148121df9f9d0d80f06cb879562c7c8a9e9b93ec7784420b6211c01acad17923d54e9b74f46b67f1003a8b2a8148c0
SSDEEP 3072:iK1y5AoKPUPdjVFXBkhNom23vMqgviuy:iKNob1jV4hum23Eqgviu
TLSH
T12E048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-22255.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22255.exe
Size 184KB
SHA256 f5371d558b89899d4d4fdc05c44fa062441f7ebda037c55184aef6a5d2c61f94
MD5 4b5815f91dcfa2146bf0e8389426e1a3
SHA1 49f7c17b14f09e22a528f16f42788eb1eeed1cf7
SHA512 da98e824bb042fe7b7b103e55d1b4d490cecdeaa3dbad7034776864092ed741b479b98d6bcf20df16140e119d1411393392b34962210abafdac338cbaf3bfc66
SSDEEP 3072:iK1y5AoKPU4djVFXmkhNWmw3vMqgviuy:iKNobkjV1hwmw3Eqgviu
TLSH
T175048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-2337.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
Size 184KB
SHA256 8762690dac0fa1373e8c8d85bab0d130385bdd49d16dfd03bbaf21a0fdfa3f8a
MD5 6676b8dc7df92209eccac693d6b47b45
SHA1 c90fa3b76a3f0370d14d8e9b41bec75cd3cc58fd
SHA512 ebe5b9cc5e86729eb1a291b83b49843faf61c527cabca50d584db8cbf1fe4bc172d7d9abf8214e246c378e43e7b2c7ec3d6f6212c27dbae2cf17fd46725b0aa7
SSDEEP 3072:iK1y5AoKPUtdjVFXmkhNWm23vMqgviuy:iKNob7jV1hwm23Eqgviu
TLSH
T1B3048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-28342.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
Size 184KB
SHA256 81d39ec62f14bb41600fa8e6137c7eb4eb2f6b2d7fe0eaecf4d592b87881f667
MD5 37799f85b3f523ecb92ea555c8a64c2a
SHA1 d2d2c84ad3324e716f23c19f450a5942ff6b3869
SHA512 3327c02329ba0aef573452316852970697391b9f780cb49d8f43f0dae9f52148f1bdf590aa59942d5cbcc2cdb5052e204e71b4ec96f427df09acaaee5a5bb2e1
SSDEEP 3072:iK1y5AoKPUPdjVFXPkhNWm23vMqgviuy:iKNob1jVKhwm23Eqgviu
TLSH
T164048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-28703.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28703.exe
Size 184KB
SHA256 198941ec8f786a429824b407371af303d8524c8d97872afaaa067c8aced05817
MD5 66d7a988abcd7d7c68bd32160579eddd
SHA1 5446828e15b7e59396ee42c8024beb790b50b31b
SHA512 228a3f18c85989f2635bf984e3d508b90cd7781f4cdd78173196765e0fec3d0e5d8dc3ebe7fb0a97faf25521f92edc2a90299c688e336426f457933665cf0c16
SSDEEP 3072:iK1y5AoKPUYdjVFXmkhNWm23vMqgviuy:iKNobEjV1hwm23Eqgviu
TLSH
T11E048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-28783.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
Size 184KB
SHA256 87dc05561b6d42350a3123e0fc999d6904071dcd3210b5afb2c11df461a82e19
MD5 c0c3bce7c86c948de5eb10b8d484ab48
SHA1 858ee938c66d36a56ab880c38804f8c449d93e9a
SHA512 cda70ad0572198d637b669303f44bb3f84cad761a7cc81611f3a2e5a605ed4f029297aee7cd9d034df794a5712b3c42fece8192fd6d8b3af3c01f2d00fe234d0
SSDEEP 3072:iK1y5AoKPUPdjVFXBkhNWm23vMqgviuy:iKNob1jV4hwm23Eqgviu
TLSH
T150048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-31627.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31627.exe
Size 184KB
SHA256 8b831c8c473f3e17e8d4975c3c09f02c342e9ee888aadc5d953ee0e351d1f14d
MD5 6b873c62b9114b10d3b8dc348221e313
SHA1 a31f45a7eb1543c78d78003c3f82e988fc53353c
SHA512 b8bf1b091c616ddd1e85fd0ef554729ac28c0a5f260bfe7f32b64b8a5499e1b5d17d5bbdd971285465f9aac43e18b9277e12a3c1d13a1551671da86957ca5cf9
SSDEEP 3072:iK1y5AoKPUPdjVFXBkh+Wm23vMqgviuy:iKNob1jV4h1m23Eqgviu
TLSH
T18E048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34569.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34569.exe
Size 184KB
SHA256 e92bc90dac102f69a1bd2f6fc7edd43fe4cb2b743b1e583236a8a2ce7e29b3f6
MD5 2459dba5b286d661bdc7b24e130008b8
SHA1 938eadc4e65d51bd9dc58c0e0821f38176939ae0
SHA512 9d942242ad6a2a964165c07778d39da6beab8e040ff278fe23e6e739962766639c2321a6a859f0ff35b63582b14c0f2f10e79dfa4251b243c5747998e918e62d
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmw3vMqgviuy:iKNob1jV1hwmw3Eqgviu
TLSH
T1E8048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-34677.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-34677.exe
Size 184KB
SHA256 6fefe89a91643a4b6efdc52f8fec5baa88e0fe8a26e2549de8a1687d19393be9
MD5 48d47bded4b89a3a73640b9c26192d29
SHA1 bdf444f0b9f4cd8980cb3febd56b2dd9a05feed8
SHA512 2580de94e95d7d0ca9b9b2ecbb19789e1f2617cbda2e515308ea62d86cdd5f2e776c6464f8fc7d2579d74eb4be13ac65d29d0ee2df3ef9188b32b575ab622593
SSDEEP 3072:iK1y5AoKPUPdjVFXBkhNWm23vMqgRiuy:iKNob1jV4hwm23EqgRiu
TLSH
T1CA048F6289B0BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-35119.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-35119.exe
Size 184KB
SHA256 9f066dcdeb6978268610fa386e783a3ff821fe7c246da4855c3c724b4b589eaa
MD5 9ac42c0e3a365b074cdde30d11dacf6b
SHA1 bbfbaa95411017f7b6d6de6375a6ed0353720626
SHA512 f2d8e2f15334f0ade29ffea7b2b89621b19fb3cc1bd79000f77d693aaba3580033b5e4d61912bd23a038b6668ad64563e05b425e6a3fd1e4396300739d0008aa
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWm23vMqgviuy:iKNob1jV1hwm23Eqgviu
TLSH
T1B9048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-42675.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42675.exe
Size 184KB
SHA256 4c83a9ef2a27648a838592b309390462d7c76f01bdc358f02ac82832d432e32c
MD5 18f63d02d3a1cb5b1a5188c009785f9c
SHA1 cd00f656189a77930f8a6566ee95ac621084c8e1
SHA512 0f434793900d57171fff5b75eebe9042b4dc0d39934f5c6258377173032b083563223515c73af28d605aafdff0c64a5493ad62e08d136e76d28f6f0d0e515a78
SSDEEP 3072:iK1y5AoKPUYdjVFXmkhNWm23vMqgviuy:iKNobEjV1hwm23Eqgviu
TLSH
T186048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-46759.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
Size 184KB
SHA256 5484c30d074c3a70ec5e70cf16330bcfe47c3282c05f2a3422ecd7193fabc2e0
MD5 1456ce0edce39ca12027014ae2bca3ce
SHA1 dca357ed0a3f2f85633324ae9c67833b3759ce8d
SHA512 bde78d978b03a71014a6b346f37e1592ba689543584ddf386bcc0f04b608b76a49b4408079715b4d0b9aa582d24cdcb749b9b8947191de9487601bf9bdf98145
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmE3vMqgvium:iKNob1jV1hwmE3Eqgviu
TLSH
T180048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-47086.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-47086.exe
Size 184KB
SHA256 d59db776c24f3c86865a2cea22aab866ecbe55a062d39ea43a1171baa555d1ce
MD5 c4035283d3bcfe41a9d9d3f0fba3c8ca
SHA1 299678224f472fbc856f671422c7f19ebab3d061
SHA512 3ba121bbbe8c679bc2b9af022e1aa48ad8581b44244b3273f10d665bbb45dabb5ec9d2c90d1fea53b57ddf51219521d7787bffcaac94f1321b5d07a509b54059
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmF3vMqgvium:iKNob1jV1hwmF3Eqgviu
TLSH
T105048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-48274.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48274.exe
Size 184KB
SHA256 636e2eea899c1db2bd2b7618a0c18d7d42aaa7eed876aaf4048d5a2842c6aa64
MD5 8ccd43b539a4713983bc19c0322652ae
SHA1 51af4bce63ff275a13c0770ec497e34cf4c99103
SHA512 3c0dac6c031cd8295a66a503a4ce064f068c90e61f713259438a1b9b5e546e5a1d69179e7f33d88e559c5c2c00cf3c9a9d3a6a9fc2e0a4d7f635b777471520ca
SSDEEP 3072:iK1ylAoKPUPdjVFXNkhNWm23vMqgviuy:iKJob1jVUhwm23Eqgviu
TLSH
T1E5048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-49590.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
Size 184KB
SHA256 cfecd52acec3e53e096b1777dab79b9e74ace55e05c5de01d82bc895e32106ca
MD5 3d45e575c190fccaab26a61bf3ae032c
SHA1 3aa7d89b6f1352aba1ae59b84498c6631d292160
SHA512 432a060c612af93ee3c814bd39fd40d467e012f1b685da774827b28c73cb5f4c2328fbc76852a524743f60188eaf9342a01271fe582520c0d23857403eee7c97
SSDEEP 3072:iK1y5AoKPUPdjVFXBkh+Wma3vMqgviuO:iKNob1jV4h1ma3Eqgviu
TLSH
T175048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-50166.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50166.exe
Size 184KB
SHA256 c63eecaa823b7b100a6ce75695c03cce5248daa986ca1fd56c0d77dfa4a05fba
MD5 3c7ffce22c21de69a31ce28d14e412bf
SHA1 0964eaa58b7ae8f96ad9cee2181f3f752d4b080a
SHA512 460a204dc39ede4a44cfcd3221daba6bd9830b2f5cab5bb4a9a0292ed5a305c390b2b821989aa13e991a078a7f9fdc2c4acb609c01dd034febfca33c80c88b94
SSDEEP 3072:iK1y5AoKPUPdjVFXPkhNWm13vMqgviuv:iKNob1jVKhwm13Eqgviu
TLSH
T12A048F628970BB13E952093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-5084.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
Size 184KB
SHA256 2d7d355204fe8e415a6ea79e850beefe71be19d8f5bb74695421cafdcac7f829
MD5 5e8705cc39244a8373d0a481a6e6f105
SHA1 b7d4888c452470da46473b94434de98b14650a7a
SHA512 7dc6da17041d4ce1319ff0b5fc2f2c33bba1992a10b2f871e45f53999054fa3054a9e7b583a44f29c6aa84a008189d935d698c3bdb9d85a6a973b59c992af4ce
SSDEEP 3072:iK1y5AoKPUPdjVFXBkhNWm63vMqgviuy:iKNob1jV4hwm63Eqgviu
TLSH
T19C048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-52174.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52174.exe
Size 184KB
SHA256 ea247b3ec8bc1788acf5577cb647d83a753ea600fb31e3d92090b74158808a0d
MD5 853210806c3ae20a6fd827f3d31818d5
SHA1 9179ed589caeceebc2126b5da30d720d5ea62c77
SHA512 2f9769cc9fc059e443a135fddcdf581fef25ccabdfe949ee2688eff8accb4707be6a8fca1ddbb5fd43af0e1a4e97e6c3a75acf72fb924a0b6d471bf44bf83a6b
SSDEEP 3072:iK1y5AoKNUPdjVFXBkh+Wm23vMqgviuy:iKNo51jV4h1m23Eqgviu
TLSH
T1B2048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-56878.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
Size 184KB
SHA256 07ba1c6277980ec23f9bcb209a4c4c6de7e7177b6ce4685eda231fe0e742fc1d
MD5 85c977b8877b8cd9e002a2b40542425e
SHA1 ee0cb8151117536baa3f8d14d6e88a28cafa4a44
SHA512 99f23383a5605d993728dfffc8e478051fbb1c7a9796c16aa6a4430ff00fc606d65b916c1014da8100abf736f5eff9714c1ba8ba15afb0d117b11b045e60678b
SSDEEP 3072:iK1y5AoKPUKdjVFXmkhNWmZ3vMqgviuy:iKNobGjV1hwmZ3Eqgviu
TLSH
T1C3048F628970BB13E952093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-59209.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-59209.exe
Size 184KB
SHA256 49312216c84fadbb1d1b5dbfaabdfda1bc74fb336a7c08a246ac3ac04efd99e4
MD5 2e8e22357b19a0fe1cdfaacce26d1acd
SHA1 66e800f4e3343f58ae9288368a400cafa379673f
SHA512 af6af3dd5d75afc1cd7b1b90974a7a549ee0d859ebc9e3dd41139b5ed8d50bbbf679617db7ffbf731a86cf9d7c053a3b5d6a369b333e814cd17d86998fae3f34
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmz3vMqgviuy:iKNob1jV1hwmz3Eqgviu
TLSH
T135048F628970BB13E951093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-61095.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-61095.exe
Size 184KB
SHA256 ec4a5b5d2807cab859d9ad90d6926949f797ae822a405b6582e3e6b16e3fc903
MD5 81ff0a77d77a0488011a17920337b4d7
SHA1 5be2e8fad94dcab67c96b083082879ab478f202c
SHA512 2679d88a852c8030fa83bdc335f685d750d9c185bf64e5961a2c9772170f82bf167dc733adab5d2c085d5d4f27f9d91aced7db42e961d045d88a95f63d1cf8f2
SSDEEP 3072:XK1y5AoKPUPdjVFXmkhNWmZ3vMqgvium:XKNob1jV1hwmZ3Eqgviu
TLSH
T12F048F6289B0BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62009.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62009.exe
Size 184KB
SHA256 1178ff0882384486e2aeadccfcfc8b1a2f6c78bf60b0bcd1475b2648e448e037
MD5 f5ea5479dfc5dd2158450b916d72a0b2
SHA1 7c0bc705c0c3623576a46c080e8e54ce85b7b355
SHA512 45837d35fb8ef3f3527a4085f8b667464320eb87db0c7cce1effa823234499152d44239848be2cd78ec59eac9682e18004d865b5ea56bd437873cf5dfb546c1f
SSDEEP 3072:iK1y5AoKPUPdjVFXPkhNWmo3vMqgviuy:iKNob1jVKhwmo3Eqgviu
TLSH
T1BA048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-62202.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62202.exe
Size 184KB
SHA256 3b26c5837a65f8d7ee3e28072c7ce45c5274fef85fe467428ab7393044ee08e8
MD5 af9b2a3d692e8021157eb2a9b2ec9dbc
SHA1 6f4a56ff0892976ad63f1488ef3ad3d1ef160d8c
SHA512 cff37ddd69ad3e2f2c68f661d76c6be2ea615eea7510e7b283cb505bfabc01a7e3aa9e66562fd28912099d91eff92960c8739df61d97579367af2fc15e0b898b
SSDEEP 3072:iK1y5AoKPUPdjVFXNkhNWm23vMqgviuy:iKNob1jVUhwm23Eqgviu
TLSH
T188048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-64064.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-64064.exe
Size 184KB
SHA256 1125d0ca7afa1520137ccb458aff6718050d7fc8dc0e71671cf1c85dccc8826d
MD5 07b58b98c1f01a13fa04514f8b8475b6
SHA1 4f4fe007e09bda0bba53bcad8cd9b854c776f550
SHA512 76fa6484b7bde6e353a6da13b6239a6c42a3e2f3d818070bcff250147a84c13d801e10ab996774bad29a3e2a71501d8622dfec0cb274512626e6bfa807adc102
SSDEEP 3072:iK1y5AoKPUPdjVFXmkhNWmY3vMqgviuy:iKNob1jV1hwmY3Eqgviu
TLSH
T124048F628970BB13E952093517E06BFB801D3C2F4BE506097CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unicorn-65491.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65491.exe
Size 184KB
SHA256 5337474e48b76c000efa43f8784a5dde2d4222bf33cb47fd309e18d462c9c15b
MD5 34cbb795a18d6b0d78c20af3267ffe39
SHA1 217127584040c06478a3cee27286d77b749f5f13
SHA512 9e66e01cba56a80990ef722c690bef4829e2241721b6c171fce286af6a44f597f4d0dd0c3c3e5927700ad03b7069d03be7bee8f12ae818e2ab4954da77f97bfc
SSDEEP 3072:pK1y5AoKPUPdjrFXBkhNomR3vMqgviuy:pKNob1jr4humR3Eqgviu
TLSH
T1E5048F628970BB13E951093517E06BFB801D3C2F4BE5060A7CADDA5F3763D9A349F942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads