bc0729d22595874397b31ed51fa15e19c6327665d167ecf1120bf5ac7f34ad52

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ed3d376be3af52957a5bf05ccfaf480N.exe
Size

468KB
MD5

7ed3d376be3af52957a5bf05ccfaf480
SHA1

6bde4850838b8dbcab5d238f1923d2de0b734555
SHA256

bc0729d22595874397b31ed51fa15e19c6327665d167ecf1120bf5ac7f34ad52
SHA512

be3fbe3eafd23dc7df0ea97b8b844b8f5e7f6864f3cf0399eb815df156b1e7e2405692204b0ac957121ea1be02c84c03d45a5c78a2f0706bb8520871bf084461
SSDEEP

3072:t+7Oog5dWJ8U1bYTPzijfx8/9ChjAWpSsdHeeVwG1fq3nlbN7llG:t+Co/aU1APejfxu2qO1folbN7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3352	Unicorn-44704.exe
1704	Unicorn-9320.exe
4992	Unicorn-38655.exe
4420	Unicorn-28745.exe
4808	Unicorn-60903.exe
3044	Unicorn-15231.exe
900	Unicorn-41774.exe
2504	Unicorn-43545.exe
4740	Unicorn-23487.exe
4016	Unicorn-26118.exe
2364	Unicorn-45984.exe
4180	Unicorn-36647.exe
2860	Unicorn-42512.exe
1624	Unicorn-26441.exe
3940	Unicorn-56752.exe
4560	Unicorn-29145.exe
1796	Unicorn-28111.exe
3996	Unicorn-47593.exe
2808	Unicorn-31257.exe
4772	Unicorn-46944.exe
3428	Unicorn-47209.exe
1580	Unicorn-47209.exe
1652	Unicorn-41079.exe
3692	Unicorn-10815.exe
4384	Unicorn-30681.exe
1844	Unicorn-33696.exe
1836	Unicorn-40695.exe
2384	Unicorn-37894.exe
4304	Unicorn-13830.exe
4784	Unicorn-47513.exe
1120	Unicorn-8518.exe
4988	Unicorn-29183.exe
1208	Unicorn-15416.exe
1504	Unicorn-47705.exe
2788	Unicorn-26582.exe
4128	Unicorn-35078.exe
4540	Unicorn-2152.exe
4544	Unicorn-50647.exe
4796	Unicorn-10559.exe
2624	Unicorn-56553.exe
3588	Unicorn-10367.exe
1852	Unicorn-3631.exe
3100	Unicorn-39375.exe
4792	Unicorn-42905.exe
3780	Unicorn-23039.exe
1500	Unicorn-6319.exe
5068	Unicorn-12671.exe
3436	Unicorn-58857.exe
1172	Unicorn-49927.exe
1112	Unicorn-61680.exe
2976	Unicorn-38830.exe
3884	Unicorn-65488.exe
1992	Unicorn-42064.exe
4336	Unicorn-41872.exe
3912	Unicorn-3142.exe
4820	Unicorn-43481.exe
1060	Unicorn-23423.exe
2640	Unicorn-43024.exe
1176	Unicorn-26953.exe
4364	Unicorn-45401.exe
2900	Unicorn-55415.exe
448	Unicorn-48032.exe
4048	Unicorn-2360.exe
1216	Unicorn-34841.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4828	4560	WerFault.exe	109
5396	5212	WerFault.exe	209
11252	6724	WerFault.exe	282
17360	7968	WerFault.exe	354

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23039.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58905.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5436	dwm.exe
Token: SeChangeNotifyPrivilege	5436	dwm.exe
Token: 33	5436	dwm.exe
Token: SeIncBasePriorityPrivilege	5436	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4496	7ed3d376be3af52957a5bf05ccfaf480N.exe
3352	Unicorn-44704.exe
1704	Unicorn-9320.exe
4992	Unicorn-38655.exe
4420	Unicorn-28745.exe
3044	Unicorn-15231.exe
4808	Unicorn-60903.exe
900	Unicorn-41774.exe
2504	Unicorn-43545.exe
4740	Unicorn-23487.exe
2364	Unicorn-45984.exe
1624	Unicorn-26441.exe
4180	Unicorn-36647.exe
2860	Unicorn-42512.exe
4016	Unicorn-26118.exe
3940	Unicorn-56752.exe
4560	Unicorn-29145.exe
1796	Unicorn-28111.exe
3996	Unicorn-47593.exe
2808	Unicorn-31257.exe
3428	Unicorn-47209.exe
4772	Unicorn-46944.exe
1844	Unicorn-33696.exe
1652	Unicorn-41079.exe
1580	Unicorn-47209.exe
4304	Unicorn-13830.exe
3692	Unicorn-10815.exe
2384	Unicorn-37894.exe
1836	Unicorn-40695.exe
4384	Unicorn-30681.exe
4784	Unicorn-47513.exe
1120	Unicorn-8518.exe
4988	Unicorn-29183.exe
1208	Unicorn-15416.exe
1504	Unicorn-47705.exe
2788	Unicorn-26582.exe
4128	Unicorn-35078.exe
4540	Unicorn-2152.exe
4544	Unicorn-50647.exe
4796	Unicorn-10559.exe
2624	Unicorn-56553.exe
3588	Unicorn-10367.exe
1852	Unicorn-3631.exe
3100	Unicorn-39375.exe
5068	Unicorn-12671.exe
1500	Unicorn-6319.exe
4792	Unicorn-42905.exe
3780	Unicorn-23039.exe
3436	Unicorn-58857.exe
4336	Unicorn-41872.exe
1172	Unicorn-49927.exe
1992	Unicorn-42064.exe
3884	Unicorn-65488.exe
2976	Unicorn-38830.exe
3912	Unicorn-3142.exe
4820	Unicorn-43481.exe
1060	Unicorn-23423.exe
1112	Unicorn-61680.exe
2640	Unicorn-43024.exe
1176	Unicorn-26953.exe
448	Unicorn-48032.exe
4364	Unicorn-45401.exe
1216	Unicorn-34841.exe
4048	Unicorn-2360.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3352	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	91
PID 4496 wrote to memory of 3352	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	91
PID 4496 wrote to memory of 3352	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	91
PID 3352 wrote to memory of 1704	3352	Unicorn-44704.exe	93
PID 3352 wrote to memory of 1704	3352	Unicorn-44704.exe	93
PID 3352 wrote to memory of 1704	3352	Unicorn-44704.exe	93
PID 4496 wrote to memory of 4992	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	94
PID 4496 wrote to memory of 4992	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	94
PID 4496 wrote to memory of 4992	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	94
PID 1704 wrote to memory of 4420	1704	Unicorn-9320.exe	96
PID 1704 wrote to memory of 4420	1704	Unicorn-9320.exe	96
PID 1704 wrote to memory of 4420	1704	Unicorn-9320.exe	96
PID 3352 wrote to memory of 4808	3352	Unicorn-44704.exe	97
PID 3352 wrote to memory of 4808	3352	Unicorn-44704.exe	97
PID 3352 wrote to memory of 4808	3352	Unicorn-44704.exe	97
PID 4992 wrote to memory of 3044	4992	Unicorn-38655.exe	98
PID 4992 wrote to memory of 3044	4992	Unicorn-38655.exe	98
PID 4992 wrote to memory of 3044	4992	Unicorn-38655.exe	98
PID 4496 wrote to memory of 900	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	99
PID 4496 wrote to memory of 900	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	99
PID 4496 wrote to memory of 900	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	99
PID 4420 wrote to memory of 2504	4420	Unicorn-28745.exe	101
PID 4420 wrote to memory of 2504	4420	Unicorn-28745.exe	101
PID 4420 wrote to memory of 2504	4420	Unicorn-28745.exe	101
PID 1704 wrote to memory of 4740	1704	Unicorn-9320.exe	102
PID 1704 wrote to memory of 4740	1704	Unicorn-9320.exe	102
PID 1704 wrote to memory of 4740	1704	Unicorn-9320.exe	102
PID 4992 wrote to memory of 4016	4992	Unicorn-38655.exe	103
PID 4992 wrote to memory of 4016	4992	Unicorn-38655.exe	103
PID 4992 wrote to memory of 4016	4992	Unicorn-38655.exe	103
PID 3044 wrote to memory of 2364	3044	Unicorn-15231.exe	104
PID 3044 wrote to memory of 2364	3044	Unicorn-15231.exe	104
PID 3044 wrote to memory of 2364	3044	Unicorn-15231.exe	104
PID 3352 wrote to memory of 4180	3352	Unicorn-44704.exe	106
PID 3352 wrote to memory of 4180	3352	Unicorn-44704.exe	106
PID 3352 wrote to memory of 4180	3352	Unicorn-44704.exe	106
PID 4496 wrote to memory of 2860	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	107
PID 4496 wrote to memory of 2860	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	107
PID 4496 wrote to memory of 2860	4496	7ed3d376be3af52957a5bf05ccfaf480N.exe	107
PID 4808 wrote to memory of 1624	4808	Unicorn-60903.exe	105
PID 4808 wrote to memory of 1624	4808	Unicorn-60903.exe	105
PID 4808 wrote to memory of 1624	4808	Unicorn-60903.exe	105
PID 900 wrote to memory of 3940	900	Unicorn-41774.exe	108
PID 900 wrote to memory of 3940	900	Unicorn-41774.exe	108
PID 900 wrote to memory of 3940	900	Unicorn-41774.exe	108
PID 2504 wrote to memory of 4560	2504	Unicorn-43545.exe	109
PID 2504 wrote to memory of 4560	2504	Unicorn-43545.exe	109
PID 2504 wrote to memory of 4560	2504	Unicorn-43545.exe	109
PID 4420 wrote to memory of 1796	4420	Unicorn-28745.exe	110
PID 4420 wrote to memory of 1796	4420	Unicorn-28745.exe	110
PID 4420 wrote to memory of 1796	4420	Unicorn-28745.exe	110
PID 4740 wrote to memory of 3996	4740	Unicorn-23487.exe	111
PID 4740 wrote to memory of 3996	4740	Unicorn-23487.exe	111
PID 4740 wrote to memory of 3996	4740	Unicorn-23487.exe	111
PID 4180 wrote to memory of 2808	4180	Unicorn-36647.exe	112
PID 4180 wrote to memory of 2808	4180	Unicorn-36647.exe	112
PID 4180 wrote to memory of 2808	4180	Unicorn-36647.exe	112
PID 3352 wrote to memory of 4772	3352	Unicorn-44704.exe	113
PID 3352 wrote to memory of 4772	3352	Unicorn-44704.exe	113
PID 3352 wrote to memory of 4772	3352	Unicorn-44704.exe	113
PID 1624 wrote to memory of 3428	1624	Unicorn-26441.exe	114
PID 1624 wrote to memory of 3428	1624	Unicorn-26441.exe	114
PID 1624 wrote to memory of 3428	1624	Unicorn-26441.exe	114
PID 1704 wrote to memory of 1652	1704	Unicorn-9320.exe	116

C:\Users\Admin\AppData\Local\Temp\7ed3d376be3af52957a5bf05ccfaf480N.exe
"C:\Users\Admin\AppData\Local\Temp\7ed3d376be3af52957a5bf05ccfaf480N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 724
        7⤵
        Program crash
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        9⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        10⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        10⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        9⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1194.exe
        9⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        9⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        8⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32682.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11875.exe
        8⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59673.exe
        8⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32614.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29156.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9721.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        7⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        6⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
        9⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5426.exe
        8⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54323.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        7⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        7⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51120.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54637.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56228.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        6⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2360.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43497.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        9⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36290.exe
        9⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
        9⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        9⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        8⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        8⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31610.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48032.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57385.exe
        8⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46407.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48996.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52267.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50075.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52713.exe
        6⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18929.exe
        8⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10026.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22505.exe
        7⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        7⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        7⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        6⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35920.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26393.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11562.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19522.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        6⤵
        
        PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43607.exe
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37042.exe
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18266.exe
        5⤵
        
        PID:16500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47705.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34841.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        10⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        10⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        10⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        10⤵
        
        PID:744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        9⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        9⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        9⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        9⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20707.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        9⤵
        
        PID:17000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        8⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34579.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62848.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11170.exe
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        9⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        9⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        8⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        7⤵
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        6⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11265.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        7⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        7⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21564.exe
        8⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10097.exe
        8⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52196.exe
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23306.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9154.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2600.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
        6⤵
        
        PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35078.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        6⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23897.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        8⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        9⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
        9⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        8⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26168.exe
        7⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        7⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31519.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45379.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24859.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45051.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42212.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50779.exe
        6⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32685.exe
        5⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49465.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60620.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        7⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        6⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59584.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49786.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58532.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7961.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        5⤵
        
        PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55650.exe
        8⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        7⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
        6⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29900.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        6⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40027.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40294.exe
        5⤵
        
        PID:5212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 488
        6⤵
        Program crash
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61011.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64636.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41872.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33766.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4650.exe
        5⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19856.exe
        5⤵
        
        PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10267.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28978.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46580.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1048.exe
        5⤵
        
        PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34018.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
      4⤵
      PID:14124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10367.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        9⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        9⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34818.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20441.exe
        8⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41387.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        7⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13547.exe
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61828.exe
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53456.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4402.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45568.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        7⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6546.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46188.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        7⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        7⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10561.exe
        6⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61369.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14844.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        9⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        9⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        9⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27138.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28137.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        7⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        7⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42602.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41371.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9069.exe
        6⤵
        
        PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56775.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24252.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20376.exe
        7⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64427.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16722.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        6⤵
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51722.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        5⤵
        
        PID:13360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
        5⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17177.exe
        6⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        7⤵
        
        PID:17196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
        6⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27901.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        6⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17897.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-383.exe
        5⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50176.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        7⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5432.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51450.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31699.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        6⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-252.exe
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48554.exe
        5⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        5⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7793.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        5⤵
        
        PID:7968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7968 -s 632
        6⤵
        Program crash
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13401.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        5⤵
        
        PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
      4⤵
      PID:10876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55245.exe
      4⤵
      PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11777.exe
      4⤵
      PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
      4⤵
      PID:16552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54633.exe
        6⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54016.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21581.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44056.exe
        8⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32649.exe
        7⤵
        
        PID:1444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        7⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24874.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18195.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        6⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1711.exe
        5⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54784.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9896.exe
        7⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37994.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36366.exe
        5⤵
        
        PID:6724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 488
        6⤵
        Program crash
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44819.exe
        5⤵
        
        PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10354.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24775.exe
        5⤵
        
        PID:16644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41120.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1435.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51634.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        7⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        6⤵
        
        PID:32
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        6⤵
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46206.exe
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33308.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61168.exe
        5⤵
        
        PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38683.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30163.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        5⤵
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        5⤵
        
        PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11243.exe
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        5⤵
        
        PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42251.exe
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17308.exe
      4⤵
      PID:15732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
      4⤵
      PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40633.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42905.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31520.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20768.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18947.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        7⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34301.exe
        6⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8271.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65005.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31441.exe
        7⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52819.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54057.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57770.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1962.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45671.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        6⤵
        
        PID:16360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        6⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        5⤵
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58979.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21698.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46355.exe
      4⤵
      PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
      4⤵
      PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
      4⤵
      PID:16184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49927.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31961.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5778.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41274.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24297.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7934.exe
        5⤵
        
        PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        5⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62410.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24787.exe
      4⤵
      PID:13356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22793.exe
      4⤵
      PID:16096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-927.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49053.exe
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46954.exe
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
      4⤵
      PID:15604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57773.exe
    3⤵
    PID:9196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
    3⤵
    PID:11828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-569.exe
    3⤵
    PID:5080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22729.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        9⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        10⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
        9⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        9⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36738.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50647.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11979.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2738.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1897.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        7⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        8⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        8⤵
        
        PID:17084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64074.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        6⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32204.exe
        7⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22697.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36258.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23039.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-767.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19869.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50723.exe
        8⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        7⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1624.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35331.exe
        6⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15370.exe
        7⤵
        
        PID:17076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7161.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38685.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49866.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63673.exe
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
        5⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2107.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
        6⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46444.exe
        5⤵
        
        PID:15076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47136.exe
        5⤵
        
        PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61680.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3544.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36252.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54435.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44979.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41755.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        6⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-236.exe
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        6⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3142.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5080.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26339.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        6⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53433.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        5⤵
        
        PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35410.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11002.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3276.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51428.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49339.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34059.exe
        6⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11507.exe
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5843.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43915.exe
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12274.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34443.exe
        5⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47856.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47948.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30307.exe
        7⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13273.exe
        7⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        7⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29442.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4418.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        6⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44739.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26889.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45000.exe
        5⤵
        
        PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61326.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1788.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        6⤵
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40042.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        5⤵
        
        PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6351.exe
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64571.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41303.exe
      4⤵
      PID:16680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12671.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63616.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15448.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45571.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42891.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61139.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23129.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36243.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63272.exe
        6⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30338.exe
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43019.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4120.exe
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        6⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31673.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31446.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47196.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52643.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41866.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        5⤵
        
        PID:16228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62834.exe
        5⤵
        
        PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-678.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65260.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27384.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14521.exe
      4⤵
      PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42064.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32921.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54089.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        5⤵
        
        PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
      4⤵
      PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16778.exe
      4⤵
      PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50066.exe
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
    3⤵
    PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6012.exe
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28371.exe
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
    3⤵
    PID:14104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58624.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16604.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        8⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14402.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        8⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5587.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8698.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34660.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40857.exe
        6⤵
        
        PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20175.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11035.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        6⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        6⤵
        
        PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29972.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23423.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49641.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
        6⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30668.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-841.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
        6⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20282.exe
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51748.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
      4⤵
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11419.exe
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18858.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63635.exe
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
      4⤵
      PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62113.exe
      4⤵
      PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18050.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21353.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24312.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13534.exe
        7⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32522.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        5⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50026.exe
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33913.exe
        5⤵
        
        PID:15480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59033.exe
        5⤵
        
        PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
      4⤵
      PID:716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        5⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17706.exe
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
        5⤵
        
        PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54890.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18186.exe
      4⤵
      PID:12668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21376.exe
      4⤵
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43024.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22361.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15228.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        5⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        5⤵
        
        PID:15416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24328.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45540.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57915.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24966.exe
    3⤵
    PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29500.exe
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
      4⤵
      PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
      4⤵
      PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-578.exe
    3⤵
    PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21243.exe
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
    3⤵
    PID:14132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42512.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42512.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10559.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37488.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9347.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5546.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50290.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24721.exe
        7⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47132.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
        6⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56512.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20010.exe
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30600.exe
        6⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48275.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39162.exe
        5⤵
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29632.exe
        5⤵
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36022.exe
        5⤵
        
        PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21638.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17561.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-667.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
        7⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13393.exe
        7⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37987.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50633.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60804.exe
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        5⤵
        
        PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24061.exe
      4⤵
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35330.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        5⤵
        
        PID:15692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28554.exe
      4⤵
      PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
      4⤵
      PID:16352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58224.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7946.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39113.exe
        6⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23417.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34827.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55303.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59298.exe
        5⤵
        
        PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1834.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63380.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
      4⤵
      PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
      4⤵
      PID:16400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54471.exe
    3⤵
    PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52864.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8195.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28794.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        5⤵
        
        PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52875.exe
      4⤵
      PID:11692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
      4⤵
      PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
      4⤵
      PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30412.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42962.exe
      4⤵
      PID:16240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
    3⤵
    PID:9704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
    3⤵
    PID:13732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18476.exe
    3⤵
    PID:16152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45968.exe
    3⤵
    PID:6832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    3⤵
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
        5⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40291.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19578.exe
        5⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        5⤵
        
        PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11139.exe
      4⤵
      PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32978.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
      4⤵
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
      4⤵
      PID:16004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17014.exe
    3⤵
    PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2866.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7793.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43859.exe
    3⤵
    PID:9860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63931.exe
    3⤵
    PID:13004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51163.exe
    3⤵
    PID:15400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65488.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33824.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24934.exe
      4⤵
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41213.exe
        5⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32082.exe
        5⤵
        
        PID:14016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25593.exe
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38954.exe
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34097.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
    3⤵
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29132.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43780.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34898.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
    3⤵
    PID:10848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
    3⤵
    PID:15060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42907.exe
    3⤵
    PID:16436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31641.exe
  2⤵
  PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
    3⤵
    PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31052.exe
      4⤵
      PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24321.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
    3⤵
    PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
    3⤵
    PID:13840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1432.exe
    3⤵
    PID:14092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18385.exe
  2⤵
  PID:7320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14523.exe
    3⤵
    PID:9916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
    3⤵
    PID:12880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe
    3⤵
    PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
    3⤵
    PID:17024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8858.exe
  2⤵
  PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
    3⤵
    PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39697.exe
    3⤵
    PID:15900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
  2⤵
  PID:13012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
  2⤵
  PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5212 -ip 5212
1⤵
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6724 -ip 6724
1⤵
PID:11196

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 7968 -ip 7968
1⤵
PID:17216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10815.exe

Filesize
468KB

MD5
0221d4cf0f0aeb7313a167590218f615

SHA1
7cabc745d2680af345dba20d20b5ebc45d90f94e

SHA256
f1f86434be18c9fdbc2a1de58b31823a612d58078a4eb4cd0e62056b76ca8db0

SHA512
569721c3314906ede100ba28b7ee9617d0815a6c952329c6334c0a3e95d01863b01c621a962950dbc87b26e7e7b50f4ff08275558b6c40a1da99cd74f582a1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13830.exe

Filesize
468KB

MD5
2b456961ab8aaaaf80d371ea2d5e1bba

SHA1
53e26e1432d58eb61c497f719ae7da42fa6223ae

SHA256
e7398f6f57f25f054e6e33b52e72f404b44e054053cd7a7535cede7023bb6b24

SHA512
d61cfc78c1ca1d89f15207d986c24967308dc4d9295ca79e09c37efdba79670b25f802ca820c9c0f77129830edbeb3c6e5db4c74ca5b3a27ab2d5abb4b44f558

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe

Filesize
468KB

MD5
d63674f78456a764ea0c7e2f282cb8f6

SHA1
a10db947489b2cbbf33ff98ebb9a5736cd1aa0a6

SHA256
d533646420f4dea9407cdb10455edad3dacf3df4ce3654a825bed3a3dd44dd4c

SHA512
822ae2ffdef30ee60b2a602b15eb455131596a15acf7a95c6404d75df357834b3164caa693b1adc3750292e379e87cd0bd962441ceea4bf525757d64cd3c6e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe

Filesize
468KB

MD5
b100180ba5b3aabd89f4c4b0399c8c3e

SHA1
7a3af687d922841d05fa8cdfeae991b1334d72d4

SHA256
0785959b6b55624828e34bea242a5468434391087555442e127165cb403fea57

SHA512
89a1fe8f9011254780fd46d3494181a7d4a7c0137439f4c3333780750e2438938ec1af44575d8ba7af7e4072e14eb4d75a85443b3640818dc2294ef513eff4d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe

Filesize
468KB

MD5
1f537a7545f5fd0eb54c5f97e0e82ab8

SHA1
8190f357c8614a85a303a788327decae1253e21d

SHA256
1e46dac6dde1f77faf2e3e3adf9261433197429ca1ab541a569caa037bf328fb

SHA512
fad36771292f87c0b9ed89c5f53004a3ff6144cae69e85298d1d80a6f720e22ddba2805afc26fb445dbcee66b6c6d3c992c49c6f5cf6dd9509a68495a8d171e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26441.exe

Filesize
468KB

MD5
17d20286ca5c3bf42d17f0883a24577b

SHA1
84121d036b3b1ce30e034b6cbd3988a82048fc9e

SHA256
15e039ce8927ddd4b9bf7dc8cef478e5a0fe7d8ca1894a5aa4ad6e003284bc3a

SHA512
e5cd47898a37230693257541268d369e8507d359e8a80569b51e7bb9603f2714da82e91a3d8e440e7fde43f394aaaaeafc2bfefe00ca702bc544f985971f2b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe

Filesize
468KB

MD5
f33fc98ee590f76ed30b0d971cf1d787

SHA1
e87c08e4a753cc06070f0be1d87147540a741bed

SHA256
5f94f85c9e682591c0e63d63d8e6938dfb71fd4b60e7e2f33decc2e2b06949c7

SHA512
94463c071596d3b97b7043ca01a3cf4cb99448f5a4735e5497dffbe8ab4cd82dd924a805cc014754c02624e2dd9dc8b85448287c4688984b47adcd5be25bc204

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28745.exe

Filesize
468KB

MD5
45be19f9aa6ca7dd432a0ec58845cee1

SHA1
95428178c696934851483c1cfde51d80c5f0b101

SHA256
08f87d085b854d8e945a3293ecd7b9ef65a4cd20a2665f5f8087bfbbee4e3784

SHA512
71720077b5996ab41bf440c83b9f388fbfa3f00df1789b3063e881353b30441d7f79fcc466795b09e1e84e40598af7b37691888557e13475c302f7d38f462469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29145.exe

Filesize
468KB

MD5
ce799f4f643a750af756cefaddc8d113

SHA1
58b27803a28b484334f813ed2fabf8e8407321e3

SHA256
c7c03e6d281da3fafa3f06d32db76bef2cf472ce107ac4bc32b2a4ae898d61a9

SHA512
0e4ce5f91afae696440c54deeb97213d5de915ef4db9476db78f62bc6586a51c6aeb43ff01dcda3be1f54339283ad8b6a8ee3610f4fe43e2a6cde4dee3e06bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29183.exe

Filesize
468KB

MD5
374700f7acbd00474310458f23b024d9

SHA1
195452b95c252a5443040c7290a0f72c63a23f18

SHA256
4d408eeeda7123945f5f53c572151cb3192b8e99cbf94fa1744bdf2238d5cf8b

SHA512
bf45627e15b5b13f91d052999fdcbc525e459b770a112c6665ae37ba71b807013e4a1615f73d846694f7bf4750c4ae87ad64535a1323c8e98918f6e85cabd990

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30681.exe

Filesize
468KB

MD5
8219d72e57856b8b44daf2dbd86f470c

SHA1
2e6fe5cd737ee40a33c2ff743deb99b3830a195a

SHA256
0a259d9e1c9581d4a46bb2cbc390dd3b5de7a99b4358ec53094c0bce648f8707

SHA512
98dbface6ce265e12e34a969638f89b5d4c62f721365e9e625e54d14740ed98e8ac74a4efbd09a20fdbe793a1c5fa82acdd241d48726057c1cd0435f198e5468

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31257.exe

Filesize
468KB

MD5
d425bb3cd88a0581bb20af9968a2cf36

SHA1
879af01369badb4c7fa267775e8099334129dce9

SHA256
46cc4372e03368d45549712847d52bdb0612d31707c74a2c0ea5dda1159fccf3

SHA512
6c3d60796bb078b5b82b60f8fcef957d5131ff6e91c11db9e5b532ab6e3a56dfaa7b59b403345610992fbf695c6a3d7cc1e5ba0bcb63c671c8663f1eed70fa6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33696.exe

Filesize
468KB

MD5
f75c2f53b58c4b34be3fcca105115331

SHA1
9250e91b63f4f9766645241294865ff790ea4fb6

SHA256
e391710b12a3c2d600df6f5fd4c0a292868f6f54006981d506b14c22f0135a77

SHA512
59919c28ea9c0dcbb913fc98310376f5b240aa02ebedb6264a6c74426de46eb1950deed078d93da2bb62023f0a96d4ecb8ff88424defa56318e64a2590bc0b01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe

Filesize
468KB

MD5
1db631cdcac57b5481dbc1e6a9a09021

SHA1
1fa42c11348fbfb3f8ae01eb62544e58b70c330b

SHA256
3face9264c7cb120d235419789743dc65af4c2d38e9f628778042b1e9120046e

SHA512
43073bd4f96946db008899fd367adde06e514182b4d0a04d061a87223d6c738cac8385003c3a3a18b0fa7e742aa4e6d5216af8ed468cdf83c706316a8e7699de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37894.exe

Filesize
468KB

MD5
b82a2dfa4258dd8c85cc17f24c4a0094

SHA1
6ecdae5883b3335997573b0934b0ed364412d8a3

SHA256
8272100cacb37d04a7d662bd3ba957485725ecbc0cb8c12f2caae319173e5d62

SHA512
39cccbaa5e5f9cfc67a7e0b8c026f1273e56d6aa93611a860948ac8185e73941bc49b55e24477cb3ffd9ea4d028971dfc52deb2953de29b403b701db05291924

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38655.exe

Filesize
468KB

MD5
4ef15ed8f2d7824b9b34e11e777fd78b

SHA1
cc671a889f8d15a617fd01534cea27e831db8fd2

SHA256
c2f19b8e3cfa3a09fec95c9c969055cfd66caf6294f13f6932cd123c4e92b754

SHA512
be6c01e825e8d5c928b418ff9616464e797741e780891dd41f11d4ac09ff11c8ff67851b0d64bdcd3b601a85c89ec07196514d7d2fc90f544aa2192c1bf84c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe

Filesize
468KB

MD5
491a0c96294a2d8488afdbee44b735cc

SHA1
d6d130dfead6e8fef3c1231cf65594226dc3b86e

SHA256
0e5217e361a6f4b20b2fc42784b2a4354072fcaaa5b92efb9258ca68a4a9d9a5

SHA512
1cb5c9a3252cca20f49732bd1af4a1f3657dd8dc2454f1fa135910ce5c2efdf7dc48318e3a0464203319afcbd8b4e950143f8eabee89f9e9dbe1259997ac0c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe

Filesize
468KB

MD5
6c10205b7ef4e6b563f34c3878816807

SHA1
81da1f6afb71faf20ec57f82a47ff29e5556b699

SHA256
736e65f10a041e1b6685d41e8963fb684dbe30f8caebabce61a3f57da6c3cdd2

SHA512
ffac443b1e0144dc1a3a5a369e14f15136f4e1e540110b8fdee8c9d312ed5a7cf79d14235ea642451979df6fbededf05c4701cb084e4837350e981c726ddc2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe

Filesize
468KB

MD5
b7d432e110ffd20dc814a46841e3a911

SHA1
9e8257f1c5d681864e8fb0525fbe2e58e41cac77

SHA256
97f4247a11d70adc3d94e6fdb8a3c3185d0c4cd634fb03221841c26aefd39e46

SHA512
64ecae22ce2a347debc95864fc2a610313a6d8acd3b8598b73ca6a41d63796eef68a37e920adb89c16caeefffaa0a16e6e2cdbef1ed7f3cc7884450cde92c23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42512.exe

Filesize
468KB

MD5
9ce482ab786d03fa0cabe82e4b78d878

SHA1
9859d89b6f4f00ee1522372817b0693f4edf318f

SHA256
95b36a5a9290625878338ac1d85a9f44ee5ed0a0a18511d732e802c42a9f175c

SHA512
34e501b309f7568a05a404c4491b8b87b02bf10991cf529f507ce04f1f61aba0b73aed557c73837589bf3aaa5ef7768a10700c46660bac4f2c587eabe2dfda78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe

Filesize
468KB

MD5
f0a9519f0cfc9791b7a6f1cd1fca15a1

SHA1
46b37aafa3451f7ad44b9283d4c1beac658777d3

SHA256
5b7430295fd4d40a2d122a7626ea0d02f809ae0df76239d12e5908132851d55b

SHA512
0721941027dcb95a157835cbe40c84abc28c57757e01871231eb551ff51b1fe7b525b10d3a096a64a7ab4d4cb9dab90434f6569d134724c1e4a50c58f6f872cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe

Filesize
468KB

MD5
4a212b7cd09f95e21668a6afd0b2396e

SHA1
29a2e5841ab58348c28da4804830ddf27232ab06

SHA256
ed55ae258937ff253c7a1ea8782e970e557a40832a567901cd4e55de34674a49

SHA512
2461baa28c68e36d95dbd272fbb91ffbc7a1a6fe0b972ecb507c77119a4bd06f612ff07e93000a68f5f130bf4829c337260c7f75cd70f7f3507511e12711ad8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe

Filesize
468KB

MD5
f17e4ce19d67854965fa56cf6c82ab10

SHA1
bcaaac981cc13744aa6e2e36a8070d52b0586d67

SHA256
68e8a021e625261ef68761ba7fdae3053a54eef2887cb6afb06de211fd9af508

SHA512
6be6933feadd183ef2e698c6b6a87f75b961010e36cda52ba5c566ee4cc236255b3399407a0609b5513e4d84c8e5deb01c1e9078e5c505d62d845984ba5a1943

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe

Filesize
468KB

MD5
8207504158c89963e1b3f097ccc9f32b

SHA1
d32ac10e6c2b78173640db9fccab62ab6c49af99

SHA256
a553f0619275cb0cda9b5032afdc48cff2712e8173e9c45fe1a78ed026b49b30

SHA512
7c3553ca33b9e2bca0daee8c421cbeab1b063fab6e51285c532750d364d3f06c836809809664e77133a233384778885b444a06195cc4296b83060f12f63d3a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe

Filesize
468KB

MD5
392d7fbe46f2311ea72bdaab47c190cf

SHA1
4bf6156c4f4f03e9ccc1714702d958da3b79b8f3

SHA256
7a0272c9db81b42d6b75ec7a00816645de0c07f866cf07a41a6d3c4eefd8375a

SHA512
82ac250046f94bc6d3c67e3f7bbabeee771859a8e274e3127567f1e7820b73c7c53715cc4bd06280dc4d6260e96fe69026cb6ef2c5cc0935b4e5905e3d90c3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47209.exe

Filesize
468KB

MD5
25b5c2f32110eda47b9eaaf7d309bf6a

SHA1
5042e451a6ae6514702077cf9055da4b4f7bb48f

SHA256
faed655ce4f0f80a8d03e3e635a062eeef278d7741ce405da31b86cb53272368

SHA512
2e629aa7c47ccf4e477d5dce08771452f5cd0d5c82c7af64bcf2b51b0f98df1630b5db4a1d4fc02588e27eead561eae38f572807b9b6bcede1a04bb4ae033655

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47513.exe

Filesize
468KB

MD5
94bea0133ff49d9433135e512f233a39

SHA1
55dbf35d4e77a8d44e762522b972be780d53cf6a

SHA256
eca21281ae4a4d9a0f36bd5cf29ae7af3d724fd30d142720954a17b871c01f02

SHA512
ae21f23960f8ad02dce8cb708ce5e3dc1cfa6bc8da04c5a3aacbc795d03b00218981e27b21e7a410517d8493c9594edee0511c853e7df18d6af75be8ad2a060b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe

Filesize
468KB

MD5
a3c2bea3e77ec07aa24c031b6ee50f9a

SHA1
ea2581fc122f35772a910b10f6e04a2284f85107

SHA256
9832f46d7fb36c59b6cc63cc283bc5042c957e694d3d37d4f9b7bfb0a8f1470e

SHA512
33b81a5236b2d5fb731e6a2a793a3fd77d774086e170205008701b22d44c1ced2ddc9f5e71dbb9f06a0831363691a526ad6f71cf6d3a3f7ca8ad5d463359a292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe

Filesize
468KB

MD5
5cac9539e3c8201d2cf97a94b1bc568d

SHA1
fb72130db203257e45509724acc07c5a4a1a10e6

SHA256
417101b78ceb849008c8f8649b1f89189b347c45818f5581a706629ea5b1a748

SHA512
b7046bfdb84b739c80a08c8dea06e1eafbf79418082ce665e5b3601bd595535ddedd425129f190a099477a692aa85ebd51b1583ff14d315c515ef5a82cb5deee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54492.exe

Filesize
468KB

MD5
deea4122ca7500265cbb202a386138fc

SHA1
4661cbd8a101f747887b33d3c8dcbe5a57900a49

SHA256
1aa6d1bf3a14cabc3a228e524ca5b8a00e0dd645194549f69bd087a931603eda

SHA512
c437dde6030db744d6b12065ecea75e9a6c625429325e1e2c74334341735bbda8b4e6be25f050a69945a6f8542058d8010c3c5aceca52a76f8fabe36931814d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe

Filesize
468KB

MD5
0433d353a7da2bebbdae1e8142bdf0af

SHA1
2296c6dd0863741c1cf9ce90c4c3104968038755

SHA256
9ff12ec37f9a62015607414cb37d03591d715562da1b63e37547330cb50b843e

SHA512
40a56981622c82bb36e3ff222faf43b318d41f5e8bb0f10a31e14a7b0b647e0782c340dabb8287cf28f58db2510401e1d9230966421fcb45bec4b79671fc2144

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe

Filesize
468KB

MD5
28842cebad9a3b39ada3bbc6849f4f99

SHA1
2cdc91a8ffad4ed9888516637100a1c9b0eb012a

SHA256
90e7e5a6d74a549fc1e74f3c00f790e66780539519d191794a8fbecf012a2967

SHA512
bc3bc26eadf5a02e9e4c0309aae56e062ca6887022e4975affd690b76c3fb5029fdba10ce04a13966a3eb998b6760df97821f81fac20588e56eaa890402a26dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8518.exe

Filesize
468KB

MD5
be1c477e87ab62e03588db481eb1100b

SHA1
74b165abe7efce14dbd101220fab5d397572d9d0

SHA256
3529d2aba22f6b4b19b9ae6f220d709815791c51c7e3b3d294c419e8aa21cfea

SHA512
7b25d6dc57e727dedc83e9e69c4fc1c5d431ce58426870f7e2a45abf52a7e5aa4949a60d1d93f6429b63bd9740871f5dca65e155851b295d30a6a509ce07d144

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9320.exe

Filesize
468KB

MD5
b98e41c3714251aaf0375d3207bc363f

SHA1
929b316201e6344e8e06bbf7546da2da42d81c50

SHA256
ecabf45c87a70ab4f41c71d9f4bcfe3f138a21e45e7a5cc451ffd3153bf337c9

SHA512
69dc5ab592ee0cceace319952690303d9e158700629963f57421a4745d0fd5101ebeb9d1ee67e60f11298729680211991744a2c4c58852b6d8bd73eb4d10e330

Download Submit
memory/448-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1016-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1172-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1388-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1504-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1840-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1844-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2640-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2788-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3780-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3912-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4560-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4884-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4988-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5520-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14712-2716-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15396-2851-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15944-2774-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16264-2907-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads