deba32ce11e552a8e87d90c08079b8ec96ebedff5efa5305950219f79b6fa670

Analysis

max time kernel
120s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
330223b78ae0afe91933f5ef3662d640N.exe
Size 468KB
Sample240913-3azt6avfrd
SHA256 deba32ce11e552a8e87d90c08079b8ec96ebedff5efa5305950219f79b6fa670
MD5 330223b78ae0afe91933f5ef3662d640
SHA1 1be04c9f7d5fd64f4d3a654848e7b06be46a65cf
SHA512 aa151329c874a77f628054954837e6e28c093866b2821fd2923b3863e7373aa8d1d9570f9d966730fa058565e3444a58ea0341bcf4a53701018b3fcf2c6d95d3
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDlC:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3884	Unicorn-49761.exe
1916	Unicorn-52042.exe
4568	Unicorn-32176.exe
2184	Unicorn-63884.exe
3248	Unicorn-4469.exe
2528	Unicorn-29820.exe
3392	Unicorn-49686.exe
3960	Unicorn-50646.exe
768	Unicorn-38948.exe
4404	Unicorn-5529.exe
4564	Unicorn-49084.exe
1020	Unicorn-29218.exe
1244	Unicorn-49084.exe
4560	Unicorn-12227.exe
1236	Unicorn-48819.exe
3456	Unicorn-42068.exe
4356	Unicorn-42430.exe
2576	Unicorn-62296.exe
1608	Unicorn-50136.exe
1412	Unicorn-54704.exe
2756	Unicorn-31881.exe
2896	Unicorn-28062.exe
1100	Unicorn-39552.exe
4296	Unicorn-22032.exe
3468	Unicorn-22032.exe
756	Unicorn-56842.exe
4012	Unicorn-45145.exe
1820	Unicorn-65010.exe
4224	Unicorn-6250.exe
1136	Unicorn-32237.exe
4992	Unicorn-53313.exe
5004	Unicorn-37346.exe
5028	Unicorn-42176.exe
8	Unicorn-62042.exe
3488	Unicorn-51544.exe
4812	Unicorn-45514.exe
872	Unicorn-37900.exe
4724	Unicorn-30745.exe
2196	Unicorn-39676.exe
2720	Unicorn-25021.exe
4976	Unicorn-25286.exe
4292	Unicorn-48399.exe
2080	Unicorn-64180.exe
2152	Unicorn-41814.exe
2932	Unicorn-64180.exe
440	Unicorn-36768.exe
4784	Unicorn-15726.exe
5068	Unicorn-29461.exe
4024	Unicorn-516.exe
2352	Unicorn-29946.exe
4340	Unicorn-32084.exe
1940	Unicorn-25953.exe
2044	Unicorn-1720.exe
2652	Unicorn-15455.exe
3980	Unicorn-21586.exe
1928	Unicorn-17502.exe
4844	Unicorn-13972.exe
1968	Unicorn-57143.exe
2364	Unicorn-27707.exe
4980	Unicorn-50942.exe
5036	Unicorn-10272.exe
4084	Unicorn-50750.exe
3912	Unicorn-52788.exe
4444	Unicorn-14377.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6224	5316	WerFault.exe	182
8208	5876	WerFault.exe	809

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23571.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15376	dwm.exe
Token: SeChangeNotifyPrivilege	15376	dwm.exe
Token: 33	15376	dwm.exe
Token: SeIncBasePriorityPrivilege	15376	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2120	330223b78ae0afe91933f5ef3662d640N.exe
3884	Unicorn-49761.exe
4568	Unicorn-32176.exe
1916	Unicorn-52042.exe
2184	Unicorn-63884.exe
2528	Unicorn-29820.exe
3248	Unicorn-4469.exe
3392	Unicorn-49686.exe
3960	Unicorn-50646.exe
768	Unicorn-38948.exe
1236	Unicorn-48819.exe
4560	Unicorn-12227.exe
1244	Unicorn-49084.exe
1020	Unicorn-29218.exe
4564	Unicorn-49084.exe
4404	Unicorn-5529.exe
3456	Unicorn-42068.exe
2576	Unicorn-62296.exe
4356	Unicorn-42430.exe
1608	Unicorn-50136.exe
1412	Unicorn-54704.exe
2756	Unicorn-31881.exe
1100	Unicorn-39552.exe
2896	Unicorn-28062.exe
1136	Unicorn-32237.exe
756	Unicorn-56842.exe
4224	Unicorn-6250.exe
4012	Unicorn-45145.exe
4296	Unicorn-22032.exe
4992	Unicorn-53313.exe
1820	Unicorn-65010.exe
3468	Unicorn-22032.exe
5004	Unicorn-37346.exe
5028	Unicorn-42176.exe
8	Unicorn-62042.exe
3488	Unicorn-51544.exe
4812	Unicorn-45514.exe
872	Unicorn-37900.exe
2196	Unicorn-39676.exe
4724	Unicorn-30745.exe
2720	Unicorn-25021.exe
4976	Unicorn-25286.exe
4292	Unicorn-48399.exe
2152	Unicorn-41814.exe
2932	Unicorn-64180.exe
440	Unicorn-36768.exe
2080	Unicorn-64180.exe
4784	Unicorn-15726.exe
5068	Unicorn-29461.exe
4024	Unicorn-516.exe
2352	Unicorn-29946.exe
4340	Unicorn-32084.exe
3980	Unicorn-21586.exe
1940	Unicorn-25953.exe
2652	Unicorn-15455.exe
2044	Unicorn-1720.exe
1928	Unicorn-17502.exe
1968	Unicorn-57143.exe
4844	Unicorn-13972.exe
2364	Unicorn-27707.exe
4980	Unicorn-50942.exe
5036	Unicorn-10272.exe
840	Unicorn-61440.exe
4084	Unicorn-50750.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3884	2120	330223b78ae0afe91933f5ef3662d640N.exe	89
PID 2120 wrote to memory of 3884	2120	330223b78ae0afe91933f5ef3662d640N.exe	89
PID 2120 wrote to memory of 3884	2120	330223b78ae0afe91933f5ef3662d640N.exe	89
PID 3884 wrote to memory of 1916	3884	Unicorn-49761.exe	93
PID 3884 wrote to memory of 1916	3884	Unicorn-49761.exe	93
PID 3884 wrote to memory of 1916	3884	Unicorn-49761.exe	93
PID 2120 wrote to memory of 4568	2120	330223b78ae0afe91933f5ef3662d640N.exe	94
PID 2120 wrote to memory of 4568	2120	330223b78ae0afe91933f5ef3662d640N.exe	94
PID 2120 wrote to memory of 4568	2120	330223b78ae0afe91933f5ef3662d640N.exe	94
PID 4568 wrote to memory of 2184	4568	Unicorn-32176.exe	97
PID 4568 wrote to memory of 2184	4568	Unicorn-32176.exe	97
PID 4568 wrote to memory of 2184	4568	Unicorn-32176.exe	97
PID 2120 wrote to memory of 3248	2120	330223b78ae0afe91933f5ef3662d640N.exe	98
PID 2120 wrote to memory of 3248	2120	330223b78ae0afe91933f5ef3662d640N.exe	98
PID 2120 wrote to memory of 3248	2120	330223b78ae0afe91933f5ef3662d640N.exe	98
PID 3884 wrote to memory of 2528	3884	Unicorn-49761.exe	99
PID 3884 wrote to memory of 2528	3884	Unicorn-49761.exe	99
PID 3884 wrote to memory of 2528	3884	Unicorn-49761.exe	99
PID 1916 wrote to memory of 3392	1916	Unicorn-52042.exe	100
PID 1916 wrote to memory of 3392	1916	Unicorn-52042.exe	100
PID 1916 wrote to memory of 3392	1916	Unicorn-52042.exe	100
PID 2184 wrote to memory of 3960	2184	Unicorn-63884.exe	101
PID 2184 wrote to memory of 3960	2184	Unicorn-63884.exe	101
PID 2184 wrote to memory of 3960	2184	Unicorn-63884.exe	101
PID 4568 wrote to memory of 768	4568	Unicorn-32176.exe	102
PID 4568 wrote to memory of 768	4568	Unicorn-32176.exe	102
PID 4568 wrote to memory of 768	4568	Unicorn-32176.exe	102
PID 2528 wrote to memory of 4404	2528	Unicorn-29820.exe	103
PID 2528 wrote to memory of 4404	2528	Unicorn-29820.exe	103
PID 2528 wrote to memory of 4404	2528	Unicorn-29820.exe	103
PID 1916 wrote to memory of 1020	1916	Unicorn-52042.exe	104
PID 1916 wrote to memory of 1020	1916	Unicorn-52042.exe	104
PID 1916 wrote to memory of 1020	1916	Unicorn-52042.exe	104
PID 3392 wrote to memory of 4564	3392	Unicorn-49686.exe	105
PID 3392 wrote to memory of 4564	3392	Unicorn-49686.exe	105
PID 3392 wrote to memory of 4564	3392	Unicorn-49686.exe	105
PID 3248 wrote to memory of 1244	3248	Unicorn-4469.exe	107
PID 3248 wrote to memory of 1244	3248	Unicorn-4469.exe	107
PID 3248 wrote to memory of 1244	3248	Unicorn-4469.exe	107
PID 3884 wrote to memory of 4560	3884	Unicorn-49761.exe	106
PID 3884 wrote to memory of 4560	3884	Unicorn-49761.exe	106
PID 3884 wrote to memory of 4560	3884	Unicorn-49761.exe	106
PID 2120 wrote to memory of 1236	2120	330223b78ae0afe91933f5ef3662d640N.exe	108
PID 2120 wrote to memory of 1236	2120	330223b78ae0afe91933f5ef3662d640N.exe	108
PID 2120 wrote to memory of 1236	2120	330223b78ae0afe91933f5ef3662d640N.exe	108
PID 3960 wrote to memory of 3456	3960	Unicorn-50646.exe	109
PID 3960 wrote to memory of 3456	3960	Unicorn-50646.exe	109
PID 3960 wrote to memory of 3456	3960	Unicorn-50646.exe	109
PID 2184 wrote to memory of 4356	2184	Unicorn-63884.exe	110
PID 2184 wrote to memory of 4356	2184	Unicorn-63884.exe	110
PID 2184 wrote to memory of 4356	2184	Unicorn-63884.exe	110
PID 768 wrote to memory of 2576	768	Unicorn-38948.exe	111
PID 768 wrote to memory of 2576	768	Unicorn-38948.exe	111
PID 768 wrote to memory of 2576	768	Unicorn-38948.exe	111
PID 4568 wrote to memory of 1608	4568	Unicorn-32176.exe	112
PID 4568 wrote to memory of 1608	4568	Unicorn-32176.exe	112
PID 4568 wrote to memory of 1608	4568	Unicorn-32176.exe	112
PID 4560 wrote to memory of 1412	4560	Unicorn-12227.exe	113
PID 4560 wrote to memory of 1412	4560	Unicorn-12227.exe	113
PID 4560 wrote to memory of 1412	4560	Unicorn-12227.exe	113
PID 3884 wrote to memory of 2756	3884	Unicorn-49761.exe	114
PID 3884 wrote to memory of 2756	3884	Unicorn-49761.exe	114
PID 3884 wrote to memory of 2756	3884	Unicorn-49761.exe	114
PID 1236 wrote to memory of 2896	1236	Unicorn-48819.exe	115

C:\Users\Admin\AppData\Local\Temp\330223b78ae0afe91933f5ef3662d640N.exe
"C:\Users\Admin\AppData\Local\Temp\330223b78ae0afe91933f5ef3662d640N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40854.exe
        9⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        9⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25274.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        8⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64028.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        8⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26121.exe
        9⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        8⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        7⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15223.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20641.exe
        8⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41434.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58219.exe
        7⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27683.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37942.exe
        7⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10920.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32084.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48934.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13869.exe
        9⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        8⤵
        
        PID:10296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27248.exe
        8⤵
        
        PID:16796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46618.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
        8⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56464.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
        7⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        8⤵
        
        PID:13224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30013.exe
        8⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39937.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51902.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        8⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        7⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        7⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        6⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45417.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15441.exe
        6⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3755.exe
        7⤵
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40528.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19065.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32008.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17502.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
        9⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38606.exe
        9⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        9⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44326.exe
        9⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        8⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        8⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18311.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56193.exe
        8⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54569.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        7⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        7⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30665.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3993.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56370.exe
        6⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2001.exe
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19899.exe
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51560.exe
        7⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59319.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28637.exe
        6⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51968.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39728.exe
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39784.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27544.exe
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50952.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        5⤵
        
        PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25286.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21726.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58861.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51813.exe
        9⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28758.exe
        9⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9913.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56028.exe
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        7⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36338.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35291.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22043.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        6⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15892.exe
        5⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        7⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        7⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57974.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3089.exe
        5⤵
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35581.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52038.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        5⤵
        
        PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64896.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        7⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        6⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15612.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32982.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        6⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61174.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        5⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4662.exe
        6⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        5⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15041.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39142.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        5⤵
        
        PID:1436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50098.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2872.exe
        6⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        8⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55441.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30177.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29334.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-413.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2239.exe
        6⤵
        
        PID:16476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64050.exe
        6⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36427.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21414.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16914.exe
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49630.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45947.exe
        5⤵
        
        PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61030.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48078.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        8⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57278.exe
        7⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        6⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8581.exe
        6⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58295.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25953.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34388.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        6⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54855.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43173.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22780.exe
        6⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        5⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25354.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27761.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        5⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15545.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49046.exe
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34504.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19756.exe
      4⤵
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41814.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29510.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        8⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        8⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21846.exe
        8⤵
        
        PID:16696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47081.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45736.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26760.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64045.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33058.exe
        7⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57285.exe
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        6⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        6⤵
        
        PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6571.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54279.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
        5⤵
        
        PID:16388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23288.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        6⤵
        
        PID:12080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4201.exe
        6⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49605.exe
        6⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36220.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1274.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39561.exe
        6⤵
        
        PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20935.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43023.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38811.exe
        5⤵
        
        PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29627.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65358.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        6⤵
        
        PID:16976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48425.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        5⤵
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62644.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64745.exe
        5⤵
        
        PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58374.exe
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
      4⤵
      PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61440.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        8⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        8⤵
        
        PID:16964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22275.exe
        7⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18286.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
        6⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45825.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4689.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55170.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11144.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44833.exe
        5⤵
        
        PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7273.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13857.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5218.exe
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56235.exe
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30193.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
        5⤵
        
        PID:16844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
      4⤵
      PID:6564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1933.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56505.exe
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4985.exe
        6⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43829.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8274.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64808.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29862.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5256.exe
        5⤵
        
        PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58076.exe
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
      4⤵
      PID:12716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
      4⤵
      PID:17040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
    3⤵
    PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40994.exe
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17580.exe
        5⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59370.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19707.exe
        6⤵
        
        PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20271.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33676.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47118.exe
        5⤵
        
        PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
      4⤵
      PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26942.exe
      4⤵
      PID:16812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13325.exe
    3⤵
    PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20437.exe
      4⤵
      PID:12736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
      4⤵
      PID:4824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
    3⤵
    PID:9176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
    3⤵
    PID:12956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35725.exe
    3⤵
    PID:8520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50942.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28166.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43646.exe
        9⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        10⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        10⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63967.exe
        9⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27009.exe
        9⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        9⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42638.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        9⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53101.exe
        9⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        9⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39348.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40757.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46662.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19166.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        7⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10272.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42276.exe
        8⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        8⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        7⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6083.exe
        6⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64606.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        8⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        7⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50500.exe
        7⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33278.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54237.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        6⤵
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41619.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64683.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11076.exe
        8⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34941.exe
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55339.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30561.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59136.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20894.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53262.exe
        7⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39629.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58068.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24413.exe
        6⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        5⤵
        Executes dropped EXE
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8415.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
        8⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        7⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27440.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15891.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22370.exe
        6⤵
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8632.exe
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16867.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        6⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26793.exe
        5⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63415.exe
        5⤵
        
        PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18338.exe
        8⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53201.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3857.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19365.exe
        6⤵
        
        PID:976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        6⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15892.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
        6⤵
        
        PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10655.exe
        5⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49256.exe
        6⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58233.exe
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64730.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
        6⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41586.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53739.exe
        7⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14791.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8621.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
        5⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8468.exe
        5⤵
        
        PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-80.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26900.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
        5⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        5⤵
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-839.exe
      4⤵
      PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39334.exe
        5⤵
        
        PID:13756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
        5⤵
        
        PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52659.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10648.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12268.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14377.exe
        6⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28244.exe
        8⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24560.exe
        9⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64248.exe
        9⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2347.exe
        8⤵
        
        PID:12572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6624.exe
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44213.exe
        7⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4637.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43392.exe
        7⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33763.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
        6⤵
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49743.exe
        5⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14351.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47729.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62800.exe
        7⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        6⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21270.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        6⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52572.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        6⤵
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2479.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16141.exe
        5⤵
        
        PID:14416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34053.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20574.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17170.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58259.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-666.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3293.exe
        7⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44943.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14699.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2796.exe
        6⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2971.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8866.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64890.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17133.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22305.exe
        5⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        5⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
        5⤵
        
        PID:392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43951.exe
        5⤵
        
        PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
      4⤵
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56474.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        7⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50434.exe
        7⤵
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22705.exe
        6⤵
        
        PID:13796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64403.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65004.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33807.exe
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42319.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7864.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47922.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        6⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47397.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28592.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13954.exe
        5⤵
        
        PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
      4⤵
      PID:11108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
      4⤵
      PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        5⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45326.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        6⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54507.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35804.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46976.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        5⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32442.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39976.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32458.exe
        6⤵
        
        PID:17140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        5⤵
        
        PID:592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13102.exe
        5⤵
        
        PID:1864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23571.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37299.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6755.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
      4⤵
      PID:14448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25021.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50444.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42526.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        6⤵
        
        PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1004.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58139.exe
        5⤵
        
        PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51662.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
      4⤵
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
    3⤵
    PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14968.exe
        5⤵
        
        PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
      4⤵
      PID:6304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56151.exe
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25120.exe
      4⤵
      PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
      4⤵
      PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52109.exe
      4⤵
      PID:16752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46268.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
    3⤵
    PID:13516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29797.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 464
      4⤵
      Program crash
      PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
    3⤵
    PID:16276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34606.exe
        6⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49458.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        8⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27941.exe
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7802.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6457.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        7⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15048.exe
        7⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14304.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-257.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59437.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18695.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38634.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22083.exe
        6⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        5⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57714.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57678.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1233.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        7⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32306.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60318.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33522.exe
        6⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15787.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31128.exe
        6⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58166.exe
        6⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42936.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58648.exe
        5⤵
        
        PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35182.exe
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60236.exe
        6⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39888.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39665.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37926.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6431.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54082.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29234.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7927.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6038.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55327.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35701.exe
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
        5⤵
        
        PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8897.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57626.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51269.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47284.exe
        6⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38912.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36043.exe
      4⤵
      PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20652.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4278.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48862.exe
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-446.exe
      4⤵
      PID:3684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17284.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50314.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5279.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29438.exe
        6⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16250.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2716.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40693.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20528.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52457.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34902.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46583.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        6⤵
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20205.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19079.exe
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42752.exe
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26127.exe
      4⤵
      PID:14420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
      4⤵
      PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40226.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3054.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        5⤵
        
        PID:13380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        5⤵
        
        PID:7072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22217.exe
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
      4⤵
      PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32780.exe
      4⤵
      PID:16320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43210.exe
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61357.exe
      4⤵
      PID:12548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
      4⤵
      PID:208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19505.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20562.exe
    3⤵
    PID:12316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25039.exe
    3⤵
    PID:2244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13370.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3905.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52430.exe
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10030.exe
        5⤵
        
        PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24907.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3132.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-770.exe
        5⤵
        
        PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44176.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41532.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
      4⤵
      PID:16740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50890.exe
        5⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8970.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27412.exe
        6⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38694.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60868.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45722.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37719.exe
        5⤵
        
        PID:17028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21065.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18774.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2767.exe
    3⤵
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43594.exe
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30028.exe
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52301.exe
      4⤵
      PID:16496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1528.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37097.exe
    3⤵
    PID:12988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45409.exe
    3⤵
    PID:8516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64180.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43557.exe
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49462.exe
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16789.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
      4⤵
      PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12168.exe
      4⤵
      PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62955.exe
    3⤵
    PID:5316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 492
      4⤵
      Program crash
      PID:6224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
    3⤵
    PID:10748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24221.exe
    3⤵
    PID:5960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36768.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
    3⤵
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47294.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2426.exe
        5⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        5⤵
        
        PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22959.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45530.exe
      4⤵
      PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
    3⤵
    PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
    3⤵
    PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
    3⤵
    PID:11952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
    3⤵
    PID:6684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49532.exe
  2⤵
  PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33702.exe
    3⤵
    PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44938.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47133.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41419.exe
      4⤵
      PID:8136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8081.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
    3⤵
    PID:13404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
  2⤵
  PID:6656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40792.exe
    3⤵
    PID:11584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48825.exe
    3⤵
    PID:15488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12446.exe
    3⤵
    PID:6336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32038.exe
  2⤵
  PID:9900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42154.exe
  2⤵
  PID:13620
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
  2⤵
  PID:16400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5316 -ip 5316
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 14292 -ip 14292
1⤵
PID:15580

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5876 -ip 5876
1⤵
PID:7948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Unicorn-12227.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-12227.exe
Size 468KB
SHA256 6b4349645957b9a6d9df8a3f325aae41e8c3b199928d181e976c87a2822192c8
MD5 de1e79cefaa9f48a0eef219bd31e472c
SHA1 39aa4882dd05a9fd96e5948cf96d262b34b0be2f
SHA512 0dc5e1c693d4c169d8c38379be1c365583583634d6f57c9ea9a80768f7da55da1fd194c7ec5df5ab8b44e6aca9c12e3b719ac838ccd578ae95961dae4c6534a8
SSDEEP 3072:DCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ANYDlC:DC6oiIUENPQjSf2LbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-16749.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-16749.exe
Size 468KB
SHA256 14637f398e3c7391528d5514c91ba10c06ff912822df02b565bee195602c5a12
MD5 01f0adea95f3b997c37849d25d9d8d12
SHA1 c4c9e8a15018b50843cbb7f91a1a7bcf4ac94918
SHA512 d7f9e7a5f4f396e1806e612b36ee4d2f855b01569e766bea7effeca4c86a26a2e58916095c291770b0ed471596f01670e08cdcfa5198c0b26dc539c7487415e7
SSDEEP 3072:pCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0VH6FxWANYDlI:pC6oiIUENPQjSf2LbhVH2kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-22032.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-22032.exe
Size 468KB
SHA256 7bf915eccc64f3e46cf51d1f5d130f17c30156b7f4db8a69d56b026c67b49c4a
MD5 58506e8b88745a89bc2dd44807560cdc
SHA1 9b33ab08072816babde2686c859f3b5b9e1e41e4
SHA512 54ce54b2cb37a66574e66074df2596f00f96558ba154e1e0e32aae81e269dfe3bf987542111877cd81d3fb2d40ed8f7ec82c5412337f9ea37ada8d436f7e676c
SSDEEP 3072:HCvCo7L+jy3UEbY2PzcjSf6iCh21I2PZmHevVW0V16Fx7ANYrlC:HC6oiIUENPQjSfDLbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-28062.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-28062.exe
Size 468KB
SHA256 af8fb6c252ac84c4f1b55c9f9f862ec1eb7e63fb620cd57e28639ce1e808d2f7
MD5 f90520f5db084b382eea37dbc3991a38
SHA1 c0e24a42b7acc201eeff91c817c25561877a7c1a
SHA512 4d3722f9e621fc02b1308e777bd456d692145feb1cf88c60abed94bf06ae2b9e450d3859134ae08a6173e62270674a888997aa94c56c1b7d62e19cf104a49f19
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW6M16FxWANYDlC:WC6oiIUENPQjSf2LbTM12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29218.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
Size 468KB
SHA256 9f71dadecf3b471cc43a38896a96b5e1308a6578ddd7815a5cab77c0a0ce73f5
MD5 101571c7dc18c2f6aa366da5fc80c56f
SHA1 6b8a698ab7756be28d438c797fbec1a18fd9080e
SHA512 7cabde563ed4864b9f171c51cd0bb1968e4af55ca473315b827ac5c7c74fedae475fb75fafc2c9af6e56086b0fe0843f290316f6148c4bffc3fa20c8634a3527
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ZNYMlC:WC6oiIUENPQjSf2LbhV121ZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-29820.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-29820.exe
Size 468KB
SHA256 240ad739e7bfa7a44ae8793e1b9ea45c449707eb9537b07227e510bf8a32a1a9
MD5 27a9a3338c840270763ecc43d115fdc0
SHA1 5c30f7e741d2b5fbca13b3b5c92b047fc0c02d7f
SHA512 31b957e91ba5b6093d2f7b24479e18ef4b5a207427070682275c9134e5f3b5e5fe54ac0effba80fa175b43aa57bfb3078df331bd81fb853bd852459a13b92754
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ANYrlC:WC6oiIUENPQjSf2LbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-31881.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-31881.exe
Size 468KB
SHA256 31f851a749664e40f75a8d81a5e49d76913404bd525618e38b7bcf9fc48de8ce
MD5 57f1c5a1977577c01b17398dce726e35
SHA1 14dffb68731341e276f0e92812203b412c19d3bc
SHA512 327e5a2c81039809fb863311d19da1a5de513f4305df3c58381fec3582a6d0e7639354e37d49f60e52fb9e58b73bbcb84d48fdc18d97533af77227093c6173dd
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxXANYDlC:WC6oiIUENPQjSf2LbhV12pANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32176.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32176.exe
Size 468KB
SHA256 bdb2c6d115c8b8f3245fd2172434ecf02e46ea7cf0bfb1a33d5e09fecb291048
MD5 974f8f1233eea120d293fb410d4e3ae7
SHA1 76cca7ada22db4ed4f1fd8625d8003f287471914
SHA512 60734f1bb5c00ecfce99e4587a1377ad4ae0b10967ae0e9c026f5814d63a933efc66b052632cb3d76a58255e9e3fc1d9cd454e76ca1d4b515e349415fdf34694
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDlj:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-32237.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
Size 468KB
SHA256 bc814ac7eff61130c08f833dde1e70019b7d8e22f64cdd45cf2eec986332eb2b
MD5 339134c66d0fef158d2388aac345b718
SHA1 c815009a28e9f2236ffbed4b54da871ae034bf05
SHA512 7879ea3480f691f2a356f074ade46e8b1d6c9cbf91b8da8bf3ae3f1c74ed098f16ad8b9712d2a99619f28adf54403ec3e25c5e6bb3f254e6bc758f1a0faba9a6
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHeTVW0V16Fx7ZNYDlC:WC6oiIUENPQjSf2LbVV121ZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-37346.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
Size 468KB
SHA256 44e11d67e8ee713dac70544f38902ea56a74f025d10d8dd1d80cc07071ec7b53
MD5 dab5e0b6adbfd541294470eabd065861
SHA1 81e1b06c48c4a071a50d6b095c604c480365de63
SHA512 5360b8694405140af159f1958122c7d0297930abd2172a710bbbb0019ca4f1064405d8befc3428730ffb36b621a6d3ebae9a788edc2d3b457551f5862d9f62f8
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0VtjFxFANYDlI:WC6oiIUENPQjSf2LbhVtRnANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-38948.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-38948.exe
Size 468KB
SHA256 c166c5cd2817a0838cc8ac9296cc1ce58e3125fd06c2a92a940268c8361bf4dc
MD5 299b4869a6bfec63d2e1ba870040f11c
SHA1 800db5edeb8d3729235c8e1d91b9aa90b88cdc40
SHA512 3548e6acf2e01f367e5d18fb5840c4a22c49b8e97337658e89b527a1d8a5593e0a55a26aed3360b4bf31b4d3c92e36b77b8cbe64695aded69d5429a00f72a5aa
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDly:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-39552.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-39552.exe
Size 468KB
SHA256 404597686e6075a9797a022ee8723861ec3b7e68d875a87c2a518e59fd091ce2
MD5 13bbeb7f324deaaec3092658e35ccd03
SHA1 95f753e90b4453fb1cb9f0274d0932e3fbd4c64a
SHA512 1c4a18bd3ee0858cfb97f5b001bdd31c7c4a9e8ea522658200111d720ec3af1b6c423f0efcbb3f9d0853867fcc5c943488f735b35ae64c90bb9885403dde5133
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FUWANYDlC:WC6oiIUENPQjSf2LbhV12nANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42068.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42068.exe
Size 468KB
SHA256 4aa06a84506ae563fbafb92c5f066e8ea4724c0571e94a6173f6b3a2d917bf2b
MD5 ba6b44b1250e896f55e307bb7c43bb24
SHA1 7dd091e6d95b99dfc6b981f5c7aaeef6cb085aef
SHA512 9e96389ebc3ad64028b44f9ba3affa427ed92526b8c6e4f042d1ff6db0e92bb688ddcd158da988dbc6e7bbc49bd2175f9855a8fbc33af7a053a16bfe03e5f8b9
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V1jFxFANYDlI:WC6oiIUENPQjSf2LbhV1RnANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42176.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42176.exe
Size 468KB
SHA256 08dadb51be0bbad1cd6d37cd97fd3277d3c2e932297f422e9046a34a2c3b88d0
MD5 77751fffa0ebb7b7191d9f06b4966888
SHA1 eb91e80bcc0ebb2e8da6e36ab5545f0c85179361
SHA512 4c11f1303a90188448aa52ec0d1e65a8cd4b196e620488d937710db82bef61bf0126371b2f4fae43540257bfcbc7f787af134dcbd3d5f44451217c421dbe386c
SSDEEP 3072:WCbCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxFANYDlI:WCuoiIUENPQjSf2LbhV12nANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-42430.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
Size 468KB
SHA256 31ae93a5c800941be336733149710fb17a1ae2346170d49fd6712da5ac464a0c
MD5 70e787db378866b1561cc0ed76a0a81f
SHA1 3b9e5b03e09aaa7688bdb5e3ffc12bf2827a997b
SHA512 f0bd3f28deb9a30da2e07425747cf5edc593b5625d35c0404a9076ad70c885e5a3eed5b0ad6a8b16793f6a49e6edd8a8904e70350a9e77285f721b7339917217
SSDEEP 3072:WCkCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDlI:WCxoiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-4469.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-4469.exe
Size 468KB
SHA256 ca1b21df7ac1f4abac6a096be9f98c06c16f6b90c5276cc2583f06139382698e
MD5 cfc1fb12e01c86716a1b6fb979532359
SHA1 468abea6c31a0f536d10dca3bd2a5544b8961c0a
SHA512 12a0349f9521a968617595852b651e8900d77ab9ba2409f9b087d8787f70b3c3ffec5e188b182be57279f6ae29e6051d9d2fa028ee886d3f93d59d2372068f6d
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDlu:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-45145.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
Size 468KB
SHA256 6509f721aa72af602d1bf01c667bceacd42b415b317fe9a87cf368a13b3fd2e8
MD5 4da9d478faf84b5d65556b5541172b05
SHA1 4b19706f4fe4af6f83724189b9c9a8fa4be3e730
SHA512 be8c642ff871fd92ba652a1df512891ac866877b06165e9166b6d930515f865232499bad854771f94cf76c30e7251d7ce742c5418ab85571f6ee87d683983ba4
SSDEEP 3072:WCvCo7Lkjy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ANYrlC:WC6o0IUENPQjSf2LbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-48819.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
Size 468KB
SHA256 8f6553aba304790ba22e1f6da42aaa71ef060ad7acffa6fccb56ff4c79fce8f7
MD5 39700cc8a41ca5b503499a47c6224423
SHA1 fe1764f807b9147f6d0cafb2038274d65691bc5a
SHA512 46f84f954370b7ab78204c005180223beab58638c809005d480f6ec1644a2c101172a5098af87c4a922dfb1d7517eaba64f3b24e2397ae1ac7ff4fd0d6108130
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0M16FxWANYDlC:WC6oiIUENPQjSf2LbhM12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49084.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49084.exe
Size 468KB
SHA256 95935feda510e082f4e32c7c1ffbc6ae95581a5181f649659ba56fa07c82b60a
MD5 3cff1b24ddc25ef268742af441c59f6d
SHA1 e2273773b4f696079e974d4b2a5bce2704feb33f
SHA512 a862fdf8a702751ec7e001853fb828e91cb856180c26b1304b9109f12957cdf6db6ebe34a1c34ed66e60d9f7cdc728d60fb99431473ce332eb0d0773533b533f
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxiZNYDlC:WC6oiIUENPQjSf2LbhV12kZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49686.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
Size 468KB
SHA256 50d81523b00d0374a34ef1747f598df17c8a8d2bd4aac5300f4232e29d178e3d
MD5 2fd2c1e8b490d253b45e7851c4ee71a4
SHA1 43aff1a5422be55528db3ea2c01ad6cdcf24d563
SHA512 4ea95991180048f894cdf46020770fdf0f49d39d2f8a2a45be31e1e14079de4b2e8f996145c7b0b78ba9a9c6c4d2788db00714062792881b6e742b57806e17da
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxPZNYDlC:WC6oiIUENPQjSf2LbhV12ZZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-49761.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-49761.exe
Size 468KB
SHA256 73b1c3cb8afa708116bc6dd72f54170ee06904a0bab236c5b4a766b7f76aa20b
MD5 bf11c495e2663ad52a3bea7d08b4ad8f
SHA1 39392e561b6cb88ea24d1e7565871099833cd5dd
SHA512 bd399f901cb83b5969f765983965d07e7cc533ffc4b656dd853a38bb18a27ac58c67f0ba653471548c4b21338ff54930268aea3a61a0b609b7c02606e88d6c56
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ANYDlC:WC6oiIUENPQjSf2LbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50136.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50136.exe
Size 468KB
SHA256 8a4ed2f7674426057653522d7f9d91b6138cd1f4cdb54d997fc3fccdc1a5e541
MD5 b8f31f85dec58571526605cb81e82129
SHA1 8f9c1db863bccb0ccd093f804ddd7e363adccc6e
SHA512 cbab9e2a9324f570ccb4248ca0e90af5a2b06ae59058b80b6f4754406e8f61a4fe021d3de155ee248968ff2f77e05df16035924cf26a0f2634fee826bcf8697e
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FRWANYDlj:WC6oiIUENPQjSf2LbhV12EANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-50646.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-50646.exe
Size 468KB
SHA256 124faf02281a97a7c40618371e3464aa8e5bae07abb98b1fc759e2441624fa06
MD5 81ff33d76f68fbc95b1764b1c5709a58
SHA1 795656116b3f03aad1706f81901e9f2a97dd413e
SHA512 f01907344d3ff975dfbf20614456ffc4148243508dc31e8a15777004ba78b12fe3039578bce1c9981e5a0524f7aac3f0328115780d5d1747969f49f610b63ed4
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxFANYDlI:WC6oiIUENPQjSf2LbhV12nANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-52042.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-52042.exe
Size 468KB
SHA256 8b65b74867b98fbc6b4a703fcc7a9ecda1b0592eae8063aba7f98c283a2fa113
MD5 56f0039b66752c544acce17437202c42
SHA1 78c6c994263aa36d0093391214406b30ffe74ab5
SHA512 8161d28edb7a998f9ef18f91c2a1dc9849b8ef0116957d52d381f11dba00bb50909c1511221e7f1199a08b69b326bcb623feb9b0c9e31e803370ec898d2cc0d4
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ZNYDlC:WC6oiIUENPQjSf2LbhV121ZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-53313.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
Size 468KB
SHA256 60bddf9b8ed382c75c65e65ab3e36760dea3c5cee449968e759bc80b070ec7eb
MD5 9a915885fe2f0e0a93bb8c7b1b296ea7
SHA1 4e600fd1efa5a05e94b4e470260e5af2fa309c34
SHA512 11ff6f98e3cdddb5486a31a2dfacf5d8b3b65fed922f4768fa1642ab1d0ec6cbbbf5c3631db933e7820d7fd8f91308555f8d4fa67f56c19753b68344e1cd4e23
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iYh2YI2PZmHevVW0V16FxPZNYDlC:WC6oiIUENPQjSfcLbhV12ZZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54518.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54518.exe
Size 468KB
SHA256 e5a125c0f001b5bbf72a54e2283779c63a35ee452c44e64363a84822aad3aab8
MD5 e647d0e0530fc3357448ba538948c08b
SHA1 17260e792da476a4144ca1d7dcdd9a0de82b9dcc
SHA512 11ca8e066548b5ccd0b5f59dd0c25934d649c9636784dff2765c8d8cec6d2f7bc6791e4f5cf646649e5031f5497d7d46069ba25d30e42be53c090457feca877c
SSDEEP 3072:+CkCo7X+jy3UEbY2Pzcj4f6iCh2YI2PZmHevVW0V16FxWANYDlm:+Cxo2IUENPQj4f2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-54704.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
Size 468KB
SHA256 ffc98bc29de117aa3e332ad2c97efe21717cc23e5c5b0c630120e2accf48e4d6
MD5 c047eadcbc02931e504883366ed0dc04
SHA1 0aeef4d756ffe9337d8ffebe7aaf3f9a6cf41e07
SHA512 a770ba1e2ee5e1977d1908def68fd712d5b17c6f6fd72011b62dc0baade91bd3ca9ca9a49f8bbb6420bf1b449a64813b035bc2c7dadb43aff2b34a0ba83f9947
SSDEEP 3072:DCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx78NYDlC:DC6oiIUENPQjSf2LbhV1218NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-5529.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
Size 468KB
SHA256 9b8ced391c21502555989296faba9c28dfbf824f9073476b28b8f9e14c36982e
MD5 650bb5c4a788003aa3ede6728d85da72
SHA1 1e024801ba460b0d37b0d04307ec27956a84b177
SHA512 976cd8fbf5bfdc4e565410175537487d52ccc313fa06c1056dd106a123d7d6d8e4c2733e6b037e2740d8a9e50d04e2274aa7d8be89e25eca017948ccd9c54c0f
SSDEEP 3072:HCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16Fx7ANYrlC:HC6oiIUENPQjSf2LbhV121ANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-56842.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-56842.exe
Size 468KB
SHA256 a0bb3c8924f8d9e393edd4a939bf7f898c4e63367b85dec8c1ad8f1da0ddf337
MD5 d1969d459ba131576486b7fc599bf6fd
SHA1 3768cfa66e74d725bd4c2cdb9b056c4bae5e49d7
SHA512 1f3a9f7b78b511095bf5c52438298b2cc63176c3b6486050db38a88c2c5fca85e72ab0eea7659448836ca0d2d99abe749ad44b296706878115ea82a9ac977aa7
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxiZNWDlC:WC6oiIUENPQjSf2LbhV12kZNW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-62296.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
Size 468KB
SHA256 11c69f9ee576914184137bde173b691bed0814667c4013d6fa917a8d9892cb7e
MD5 6f9c20c9d0114464a081f0e226152e6e
SHA1 093f7ca5c1bb6ee8ec496450ba2170664f104c53
SHA512 8d03d3aabc1e5e3921c606fb317620d0594d354359a73a9a8a5ea9e0163ab0e27e2df1896df6c3172cb99258b8299240d329b794dd3bffddc7503859329f42e4
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYkly:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-6250.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
Size 468KB
SHA256 26c6d8efa116715bfba78d797f9cd1599ea5ff6cd7bf6eac7899e53e8701a941
MD5 a0b1dc9109ffb175728a1df3747fe913
SHA1 c3b03e54eaa4a7b250482c5b24855bd4a0003e71
SHA512 45e3f387c4852e8919994dcd31763992afd78d002c023ebda394e885fc90e538b4bfd78a6ac98efb4eb0af012e1d8e328e9ffba8f69164161f5b2402cb4e6404
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0Vb6FxWANYDlu:WC6oiIUENPQjSf2LbhVb2kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-63884.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
Size 468KB
SHA256 9ec377b42950b2935b9d2f74ed07077930b20d7aa692e8ddef694eca23b04f43
MD5 d107a0292b0fed59a5d2aa836eb7d247
SHA1 a4ec5624aa7c8fb81400b4f19a171e988b595e89
SHA512 d8a73ea161daec2ada595860edfcccd43ffafb6b43e7d8755350ad5f131506ba4b754d1fa25a786a94a6ee7cd1f4f6c6f168cbc6bef141ac168d5f96cb8cc437
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxWANYDlI:WC6oiIUENPQjSf2LbhV12kANY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unicorn-65010.exe

Path C:\Users\Admin\AppData\Local\Temp\Unicorn-65010.exe
Size 468KB
SHA256 731a5c142acabc7b656750b1e98076ec531252e3618524e61049e879c72915cb
MD5 462aed351ee80a1618c56d4687d50598
SHA1 5853e41075267d4be3b84adc2e0aa3fb181addfd
SHA512 69daa4094d55e3fd1a6ab5164d64da4430247f5eb8acd0539a8db054590ed40383d01ec2b3fdb9fe553dbe72ce8495ccee66e182d63524b39c3c566db1849b74
SSDEEP 3072:WCvCo7L+jy3UEbY2PzcjSf6iCh2YI2PZmHevVW0V16FxiZNYDlW:WC6oiIUENPQjSf2LbhV12kZNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-227-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/436-399-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/440-288-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/756-172-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/768-61-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/840-396-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/872-244-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/924-412-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1020-88-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1100-180-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1136-196-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1208-447-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1236-90-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1412-141-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1596-406-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1608-128-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1696-420-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1708-401-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1712-439-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1820-194-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1916-18-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1928-333-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1940-329-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/1968-356-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2044-330-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2080-284-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2120-0-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2152-285-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2184-27-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2196-252-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2352-322-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2364-360-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2484-453-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2528-44-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2576-119-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2652-331-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2720-263-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2756-145-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2824-402-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/2896-154-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3068-394-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3192-392-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3248-33-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3392-45-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3456-106-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3488-235-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3884-6-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3912-389-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3960-55-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/3980-332-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4012-184-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4024-309-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4084-375-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4224-195-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4292-269-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4296-171-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4340-350-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4356-118-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4404-76-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4444-390-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4560-89-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4564-87-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4568-19-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4724-251-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4784-298-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4812-239-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4844-344-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4916-403-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4924-437-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4976-264-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4980-361-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/4992-197-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5004-217-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5028-226-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5036-363-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5068-302-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5132-454-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5188-484-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5200-492-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5212-485-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5232-500-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5240-496-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5248-535-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5256-3337-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5316-527-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5324-528-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5336-529-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5504-536-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5540-537-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5608-538-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5624-539-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5652-540-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5692-541-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5704-542-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5716-543-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5740-544-0x0000000000400000-0x0000000000475000-memory.dmp

Download

memory/5764-556-0x0000000000400000-0x0000000000475000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads