4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869

Analysis

max time kernel
142s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe
Size

468KB
MD5

8645c7d2ea789b2457b39094ee244cca
SHA1

47d57dc9d61d99c89a2755ced6cf14238bca87b6
SHA256

4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869
SHA512

4229638baa62935b9d5b5c25c90d0da27674d741c0d115f63d21562ec24449996efdc448e8f5a7d763033d33295092cc8effd30f0a72586a22bc13c6677d117f
SSDEEP

3072:abZ2ogHdIf5JsrYJ/ztkcf8/EChCPI4wnmHemEh89KH88lwukVlT:ab4oXBJs+/Jkcf/dK+9Kc4wuk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2696	Unicorn-59696.exe
4712	Unicorn-44320.exe
1260	Unicorn-28538.exe
1960	Unicorn-47478.exe
184	Unicorn-47478.exe
3492	Unicorn-31696.exe
2128	Unicorn-45432.exe
3956	Unicorn-38900.exe
3988	Unicorn-23118.exe
2732	Unicorn-57374.exe
2216	Unicorn-57374.exe
1924	Unicorn-1951.exe
4584	Unicorn-61358.exe
512	Unicorn-47623.exe
320	Unicorn-1686.exe
4556	Unicorn-34406.exe
1780	Unicorn-26792.exe
3452	Unicorn-40436.exe
2916	Unicorn-15932.exe
3808	Unicorn-9801.exe
928	Unicorn-8318.exe
352	Unicorn-38298.exe
220	Unicorn-3487.exe
3564	Unicorn-37535.exe
4948	Unicorn-54726.exe
3708	Unicorn-40990.exe
4524	Unicorn-60856.exe
4424	Unicorn-60591.exe
4388	Unicorn-60856.exe
3984	Unicorn-60856.exe
2652	Unicorn-40990.exe
2028	Unicorn-27390.exe
2784	Unicorn-48365.exe
2244	Unicorn-6777.exe
4876	Unicorn-31373.exe
1296	Unicorn-16892.exe
1152	Unicorn-19606.exe
5072	Unicorn-33804.exe
1432	Unicorn-56917.exe
3400	Unicorn-40580.exe
4960	Unicorn-35750.exe
4880	Unicorn-33703.exe
1736	Unicorn-39834.exe
3712	Unicorn-3632.exe
940	Unicorn-54224.exe
3504	Unicorn-19148.exe
4052	Unicorn-21914.exe
1108	Unicorn-40410.exe
1620	Unicorn-54800.exe
4260	Unicorn-54800.exe
2804	Unicorn-58884.exe
1520	Unicorn-6776.exe
4560	Unicorn-3461.exe
1564	Unicorn-28057.exe
2988	Unicorn-38272.exe
2444	Unicorn-38272.exe
3428	Unicorn-17852.exe
3948	Unicorn-2070.exe
4872	Unicorn-63523.exe
2124	Unicorn-17586.exe
1268	Unicorn-50616.exe
3408	Unicorn-40964.exe
3840	Unicorn-8921.exe
4928	Unicorn-65298.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6304	4872	WerFault.exe	147
18048	17284	WerFault.exe	826
19252	16308	Process not Found	1272

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65458.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1339.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62719.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24618.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21519.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17624	dwm.exe
Token: SeChangeNotifyPrivilege	17624	dwm.exe
Token: 33	17624	dwm.exe
Token: SeIncBasePriorityPrivilege	17624	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe
2696	Unicorn-59696.exe
1260	Unicorn-28538.exe
4712	Unicorn-44320.exe
1960	Unicorn-47478.exe
184	Unicorn-47478.exe
2128	Unicorn-45432.exe
3492	Unicorn-31696.exe
3956	Unicorn-38900.exe
3988	Unicorn-23118.exe
2732	Unicorn-57374.exe
1924	Unicorn-1951.exe
512	Unicorn-47623.exe
2216	Unicorn-57374.exe
320	Unicorn-1686.exe
4584	Unicorn-61358.exe
4556	Unicorn-34406.exe
1780	Unicorn-26792.exe
3452	Unicorn-40436.exe
3808	Unicorn-9801.exe
2916	Unicorn-15932.exe
220	Unicorn-3487.exe
352	Unicorn-38298.exe
3564	Unicorn-37535.exe
928	Unicorn-8318.exe
4388	Unicorn-60856.exe
4424	Unicorn-60591.exe
4524	Unicorn-60856.exe
3984	Unicorn-60856.exe
4948	Unicorn-54726.exe
3708	Unicorn-40990.exe
2652	Unicorn-40990.exe
2028	Unicorn-27390.exe
2784	Unicorn-48365.exe
2244	Unicorn-6777.exe
4876	Unicorn-31373.exe
1296	Unicorn-16892.exe
1152	Unicorn-19606.exe
1432	Unicorn-56917.exe
5072	Unicorn-33804.exe
3400	Unicorn-40580.exe
4960	Unicorn-35750.exe
4880	Unicorn-33703.exe
1736	Unicorn-39834.exe
940	Unicorn-54224.exe
3504	Unicorn-19148.exe
4052	Unicorn-21914.exe
3712	Unicorn-3632.exe
1108	Unicorn-40410.exe
1620	Unicorn-54800.exe
4260	Unicorn-54800.exe
2804	Unicorn-58884.exe
4560	Unicorn-3461.exe
1520	Unicorn-6776.exe
2444	Unicorn-38272.exe
2988	Unicorn-38272.exe
1564	Unicorn-28057.exe
4872	Unicorn-63523.exe
3428	Unicorn-17852.exe
3948	Unicorn-2070.exe
2124	Unicorn-17586.exe
3840	Unicorn-8921.exe
1268	Unicorn-50616.exe
3408	Unicorn-40964.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2696	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	86
PID 2628 wrote to memory of 2696	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	86
PID 2628 wrote to memory of 2696	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	86
PID 2696 wrote to memory of 4712	2696	Unicorn-59696.exe	88
PID 2696 wrote to memory of 4712	2696	Unicorn-59696.exe	88
PID 2696 wrote to memory of 4712	2696	Unicorn-59696.exe	88
PID 2628 wrote to memory of 1260	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	89
PID 2628 wrote to memory of 1260	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	89
PID 2628 wrote to memory of 1260	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	89
PID 1260 wrote to memory of 1960	1260	Unicorn-28538.exe	93
PID 1260 wrote to memory of 1960	1260	Unicorn-28538.exe	93
PID 1260 wrote to memory of 1960	1260	Unicorn-28538.exe	93
PID 4712 wrote to memory of 184	4712	Unicorn-44320.exe	92
PID 4712 wrote to memory of 184	4712	Unicorn-44320.exe	92
PID 4712 wrote to memory of 184	4712	Unicorn-44320.exe	92
PID 2628 wrote to memory of 2128	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	94
PID 2628 wrote to memory of 2128	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	94
PID 2628 wrote to memory of 2128	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	94
PID 2696 wrote to memory of 3492	2696	Unicorn-59696.exe	95
PID 2696 wrote to memory of 3492	2696	Unicorn-59696.exe	95
PID 2696 wrote to memory of 3492	2696	Unicorn-59696.exe	95
PID 1960 wrote to memory of 3956	1960	Unicorn-47478.exe	96
PID 1960 wrote to memory of 3956	1960	Unicorn-47478.exe	96
PID 1960 wrote to memory of 3956	1960	Unicorn-47478.exe	96
PID 1260 wrote to memory of 3988	1260	Unicorn-28538.exe	97
PID 1260 wrote to memory of 3988	1260	Unicorn-28538.exe	97
PID 1260 wrote to memory of 3988	1260	Unicorn-28538.exe	97
PID 184 wrote to memory of 2732	184	Unicorn-47478.exe	99
PID 184 wrote to memory of 2732	184	Unicorn-47478.exe	99
PID 184 wrote to memory of 2732	184	Unicorn-47478.exe	99
PID 2128 wrote to memory of 2216	2128	Unicorn-45432.exe	98
PID 2128 wrote to memory of 2216	2128	Unicorn-45432.exe	98
PID 2128 wrote to memory of 2216	2128	Unicorn-45432.exe	98
PID 3492 wrote to memory of 1924	3492	Unicorn-31696.exe	100
PID 3492 wrote to memory of 1924	3492	Unicorn-31696.exe	100
PID 3492 wrote to memory of 1924	3492	Unicorn-31696.exe	100
PID 2696 wrote to memory of 4584	2696	Unicorn-59696.exe	101
PID 2696 wrote to memory of 4584	2696	Unicorn-59696.exe	101
PID 2696 wrote to memory of 4584	2696	Unicorn-59696.exe	101
PID 4712 wrote to memory of 512	4712	Unicorn-44320.exe	103
PID 4712 wrote to memory of 512	4712	Unicorn-44320.exe	103
PID 4712 wrote to memory of 512	4712	Unicorn-44320.exe	103
PID 2628 wrote to memory of 320	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	102
PID 2628 wrote to memory of 320	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	102
PID 2628 wrote to memory of 320	2628	4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe	102
PID 3956 wrote to memory of 4556	3956	Unicorn-38900.exe	104
PID 3956 wrote to memory of 4556	3956	Unicorn-38900.exe	104
PID 3956 wrote to memory of 4556	3956	Unicorn-38900.exe	104
PID 1960 wrote to memory of 1780	1960	Unicorn-47478.exe	105
PID 1960 wrote to memory of 1780	1960	Unicorn-47478.exe	105
PID 1960 wrote to memory of 1780	1960	Unicorn-47478.exe	105
PID 3988 wrote to memory of 3452	3988	Unicorn-23118.exe	106
PID 3988 wrote to memory of 3452	3988	Unicorn-23118.exe	106
PID 3988 wrote to memory of 3452	3988	Unicorn-23118.exe	106
PID 1260 wrote to memory of 3808	1260	Unicorn-28538.exe	107
PID 1260 wrote to memory of 3808	1260	Unicorn-28538.exe	107
PID 1260 wrote to memory of 3808	1260	Unicorn-28538.exe	107
PID 2732 wrote to memory of 2916	2732	Unicorn-57374.exe	108
PID 2732 wrote to memory of 2916	2732	Unicorn-57374.exe	108
PID 2732 wrote to memory of 2916	2732	Unicorn-57374.exe	108
PID 184 wrote to memory of 928	184	Unicorn-47478.exe	109
PID 184 wrote to memory of 928	184	Unicorn-47478.exe	109
PID 184 wrote to memory of 928	184	Unicorn-47478.exe	109
PID 320 wrote to memory of 352	320	Unicorn-1686.exe	111

C:\Users\Admin\AppData\Local\Temp\4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe
"C:\Users\Admin\AppData\Local\Temp\4550c3810cd6c8927f1404da810cda9cdb4009ba1cdbd13789972690c36a7869.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51448.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34270.exe
        9⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        10⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        10⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        10⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        10⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        9⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        9⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        9⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18528.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        8⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
        9⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6414.exe
        9⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
        9⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50638.exe
        9⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24243.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53923.exe
        8⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        8⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        9⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        9⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3840.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        8⤵
        
        PID:17916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35370.exe
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54302.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11380.exe
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        8⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11504.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8264.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40580.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51256.exe
        7⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5537.exe
        8⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        9⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        9⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        9⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59263.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33413.exe
        8⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32403.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        8⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        8⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52299.exe
        7⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        7⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49831.exe
        7⤵
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        6⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        7⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15926.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-762.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38048.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        7⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10290.exe
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        7⤵
        
        PID:18304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24479.exe
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        6⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16446.exe
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        9⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        9⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10301.exe
        9⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42734.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        8⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9652.exe
        8⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14032.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2238.exe
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        7⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39141.exe
        7⤵
        
        PID:18288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9408.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32516.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20006.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        8⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        8⤵
        
        PID:17464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        7⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        7⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59945.exe
        7⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33615.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39082.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        7⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        7⤵
        
        PID:17868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-493.exe
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15407.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
        8⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28701.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7976.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41444.exe
        7⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33495.exe
        7⤵
        
        PID:17460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        8⤵
        
        PID:18008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16170.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57804.exe
        7⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        6⤵
        
        PID:17780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        7⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        7⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        6⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44636.exe
        5⤵
        
        PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17852.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62102.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45475.exe
        8⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        7⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        7⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51017.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6087.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26834.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2516.exe
        8⤵
        
        PID:18412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57966.exe
        7⤵
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35688.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13487.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23570.exe
        8⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54934.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        7⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        7⤵
        
        PID:18420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38995.exe
        7⤵
        
        PID:18120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        7⤵
        
        PID:13216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
        7⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        7⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        6⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50215.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4861.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        6⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        7⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        7⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35563.exe
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25446.exe
        5⤵
        
        PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4603.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55615.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        8⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23710.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6217.exe
        7⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11048.exe
        6⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33118.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21542.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38510.exe
        7⤵
        
        PID:14384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40233.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47561.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        6⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8422.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15979.exe
        5⤵
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32765.exe
        5⤵
        
        PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10991.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55096.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46025.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        7⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        7⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23683.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22075.exe
        6⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35037.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        5⤵
        
        PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35885.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47250.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        5⤵
        
        PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-417.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37547.exe
      4⤵
      PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
      4⤵
      PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        9⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48075.exe
        9⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4327.exe
        9⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21842.exe
        9⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        8⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37546.exe
        8⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        8⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        8⤵
        
        PID:17592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        7⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42272.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        8⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        6⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 632
        6⤵
        Program crash
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38686.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34193.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45258.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17726.exe
        5⤵
        
        PID:16280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5923.exe
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54800.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-877.exe
        6⤵
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17317.exe
        7⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        6⤵
        
        PID:17736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53150.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        7⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44641.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50493.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        6⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9277.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        5⤵
        
        PID:18316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36593.exe
        7⤵
        
        PID:18132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53040.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        6⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17358.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        5⤵
        
        PID:15876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44551.exe
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49450.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18636.exe
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21406.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36486.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        5⤵
        
        PID:17728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
      4⤵
      PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38272.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
        6⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28646.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7753.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16283.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        8⤵
        
        PID:18276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9830.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19766.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47482.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46435.exe
        6⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32891.exe
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41950.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26897.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49101.exe
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        5⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        6⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50118.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16782.exe
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        5⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32189.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46854.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        5⤵
        
        PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42361.exe
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41366.exe
      4⤵
      PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52729.exe
      4⤵
      PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
      4⤵
      PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
      4⤵
      PID:3620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3461.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        7⤵
        
        PID:17940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26927.exe
        6⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53129.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38480.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22008.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        6⤵
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45946.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47997.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24796.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45292.exe
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
        5⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
        5⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        5⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        5⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22262.exe
      4⤵
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23789.exe
      4⤵
      PID:12956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37674.exe
      4⤵
      PID:18364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64605.exe
      4⤵
      PID:17288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8921.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48163.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        5⤵
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9590.exe
        5⤵
        
        PID:18336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        5⤵
        
        PID:15832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43171.exe
      4⤵
      PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
      4⤵
      PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
      4⤵
      PID:7144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
      4⤵
      PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
        5⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33736.exe
        5⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54623.exe
        5⤵
        
        PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
      4⤵
      PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36062.exe
      4⤵
      PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27428.exe
    3⤵
    PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
    3⤵
    PID:11192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17272.exe
    3⤵
    PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15297.exe
    3⤵
    PID:7152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65298.exe
        7⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62719.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        9⤵
        
        PID:17312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50886.exe
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        9⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2776.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3727.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
        8⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36206.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        8⤵
        
        PID:17512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39332.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14675.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52984.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33114.exe
        8⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        9⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7426.exe
        9⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        9⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        9⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        8⤵
        
        PID:18060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32035.exe
        8⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        8⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14400.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        7⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-187.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        7⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59607.exe
        7⤵
        
        PID:17932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1074.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26337.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        6⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30630.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        6⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14001.exe
        9⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        8⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3621.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57264.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54883.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10360.exe
        7⤵
        
        PID:18004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23130.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41312.exe
        7⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        7⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        7⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
        7⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18666.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65310.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46724.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34510.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62086.exe
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        8⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        8⤵
        
        PID:18148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        8⤵
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29065.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47457.exe
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
        6⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24282.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        6⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        6⤵
        
        PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53670.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7856.exe
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        5⤵
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46582.exe
        5⤵
        
        PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34380.exe
        6⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26102.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        8⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33553.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        8⤵
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19713.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4468.exe
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40570.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        7⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19112.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        6⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        6⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22682.exe
        5⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14447.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59450.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        8⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6600.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5978.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57853.exe
        7⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61271.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33005.exe
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9917.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20798.exe
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59648.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17469.exe
        5⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        5⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50270.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11686.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64202.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        7⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54857.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13914.exe
        6⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46134.exe
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38214.exe
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14311.exe
        6⤵
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48748.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37587.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        5⤵
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
      4⤵
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3783.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3565.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50405.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        7⤵
        
        PID:16892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18277.exe
        7⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        6⤵
        
        PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42236.exe
        6⤵
        
        PID:12764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        6⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60296.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27087.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64324.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8261.exe
        5⤵
        
        PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1267.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24692.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        5⤵
        
        PID:17872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        5⤵
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55648.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
      4⤵
      PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16892.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        6⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35828.exe
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30686.exe
        9⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42324.exe
        8⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30748.exe
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14592.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        7⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41766.exe
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        7⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8474.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57469.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31005.exe
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38163.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19008.exe
        6⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17542.exe
        6⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        5⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49450.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30263.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        7⤵
        
        PID:17524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18292.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8971.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63382.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8064.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37446.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6627.exe
        6⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29663.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54265.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2055.exe
        5⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27741.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        7⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        7⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4286.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31721.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        6⤵
        
        PID:16340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37778.exe
        5⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41988.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7487.exe
        6⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        6⤵
        
        PID:17588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38572.exe
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47831.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        5⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21146.exe
        5⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57999.exe
        5⤵
        
        PID:6752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33820.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60135.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34129.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        6⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7924.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        5⤵
        
        PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37343.exe
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46326.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52896.exe
        6⤵
        
        PID:17284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17284 -s 464
        7⤵
        Program crash
        
        PID:18048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17151.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48713.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6527.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56867.exe
        5⤵
        
        PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45948.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
      4⤵
      PID:12284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24485.exe
      4⤵
      PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
      4⤵
      PID:18380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33271.exe
      4⤵
      PID:892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        5⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3975.exe
        6⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61474.exe
        7⤵
        
        PID:17536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1187.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12392.exe
        6⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        6⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48812.exe
        7⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22413.exe
        7⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31223.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38380.exe
      4⤵
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        6⤵
        
        PID:13184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        6⤵
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19704.exe
        6⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3800.exe
        6⤵
        
        PID:18068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55563.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56356.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        5⤵
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11039.exe
        5⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        5⤵
        
        PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34191.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53638.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51749.exe
        5⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        5⤵
        
        PID:18268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        5⤵
        
        PID:18384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59787.exe
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
      4⤵
      PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19148.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
      4⤵
      PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8251.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7841.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52242.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23326.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        7⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10903.exe
        7⤵
        
        PID:16100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21519.exe
        6⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
        5⤵
        
        PID:15212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        5⤵
        
        PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15594.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
        5⤵
        
        PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
      4⤵
      PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55382.exe
        5⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24882.exe
        5⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
      4⤵
      PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
      4⤵
      PID:7140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
    3⤵
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48786.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50789.exe
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        5⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        5⤵
        
        PID:18392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        5⤵
        
        PID:17788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
      4⤵
      PID:13092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
    3⤵
    PID:8168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
    3⤵
    PID:10948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56047.exe
    3⤵
    PID:15192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:18136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6139.exe
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-83.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56570.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23762.exe
        8⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16231.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27240.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12008.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16885.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24043.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17742.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3787.exe
        7⤵
        
        PID:16808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34871.exe
        6⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28200.exe
        7⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37571.exe
        7⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28449.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14924.exe
        6⤵
        
        PID:16484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33908.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43498.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35770.exe
        7⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5671.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36975.exe
        6⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4425.exe
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44219.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2383.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34998.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38790.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        7⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10062.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-549.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60799.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14551.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5422.exe
        6⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34526.exe
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17305.exe
      4⤵
      PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16394.exe
        5⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11213.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12465.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56175.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        5⤵
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64432.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21234.exe
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
      4⤵
      PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34676.exe
        6⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13399.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37768.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        7⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
        7⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14250.exe
        6⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        6⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9932.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38738.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33607.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24566.exe
      4⤵
      PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14255.exe
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55776.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4494.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3725.exe
        6⤵
        
        PID:18312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8381.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52439.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52246.exe
        5⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        5⤵
        
        PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      4⤵
      PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45202.exe
      4⤵
      PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
      4⤵
      PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28057.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46060.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25844.exe
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54297.exe
        5⤵
        
        PID:13224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        5⤵
        
        PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
      4⤵
      PID:13460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17610.exe
      4⤵
      PID:232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50005.exe
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53975.exe
      4⤵
      PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51823.exe
      4⤵
      PID:2824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21443.exe
    3⤵
    PID:7888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
    3⤵
    PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
    3⤵
    PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
    3⤵
    PID:3392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52129.exe
    3⤵
    PID:1320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
        5⤵
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46456.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46321.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3071.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        6⤵
        
        PID:17520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10711.exe
        6⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-934.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22977.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        5⤵
        
        PID:16008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        5⤵
        
        PID:18340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28135.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50031.exe
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-404.exe
      4⤵
      PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
      4⤵
      PID:6360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
      4⤵
      PID:8
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14665.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        6⤵
        
        PID:17568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5017.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44811.exe
        5⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        5⤵
        
        PID:17752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44961.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30481.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        5⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20513.exe
        5⤵
        
        PID:17128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31171.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24095.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
      4⤵
      PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
      4⤵
      PID:16332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
    3⤵
    PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63601.exe
      4⤵
      PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63626.exe
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
      4⤵
      PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24604.exe
      4⤵
      PID:2036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34001.exe
    3⤵
    PID:7160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
    3⤵
    PID:11540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
    3⤵
    PID:15632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40410.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61754.exe
      4⤵
      PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7265.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        6⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54458.exe
        7⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54318.exe
        7⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
        6⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62875.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56227.exe
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39906.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        5⤵
        
        PID:16624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        5⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8421.exe
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62850.exe
      4⤵
      PID:16320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
      4⤵
      PID:8816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34104.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55288.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1339.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22313.exe
        5⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
        5⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50318.exe
        5⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42879.exe
        5⤵
        
        PID:18064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
      4⤵
      PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29905.exe
      4⤵
      PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
      4⤵
      PID:18328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
      4⤵
      PID:15984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20524.exe
      4⤵
      PID:17620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41411.exe
      4⤵
      PID:18272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26705.exe
    3⤵
    PID:10728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
    3⤵
    PID:15072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6776.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
    3⤵
    PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40644.exe
        5⤵
        
        PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24618.exe
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31825.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
      4⤵
      PID:17516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36382.exe
    3⤵
    PID:8112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48661.exe
    3⤵
    PID:12336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
    3⤵
    PID:16172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60920.exe
  2⤵
  PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
    3⤵
    PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64987.exe
      4⤵
      PID:12508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38946.exe
      4⤵
      PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19527.exe
      4⤵
      PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13544.exe
    3⤵
    PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60606.exe
    3⤵
    PID:14504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    3⤵
    PID:3036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
  2⤵
  PID:7968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18922.exe
  2⤵
  PID:12156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
  2⤵
  PID:16204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4872 -ip 4872
1⤵
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 17588 -ip 17588
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 17284 -ip 17284
1⤵
PID:1164

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15932.exe

Filesize
468KB

MD5
ba1855128e1b17b5a0de9eb6a187501f

SHA1
14b51671486ad16e4f2393f8f2fa203a2c12cf0f

SHA256
6d91d8351471ee3bf0df0540a0276b2f238c6b5c525f2df9e8b27df985c7e552

SHA512
284260b78a2d09ed84cb7f039150408b53023ceb3dc060da9f0488d9beb810ae13c42743388e14635b5284d53509f360c5242316386a9ea5b764f22d166cd9ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe

Filesize
468KB

MD5
5f92194a10e37dddb5a9e2d2b6140b6b

SHA1
22eef60ac2fb23c757ba9da5e74360e7f5dc94db

SHA256
bfb6d77771ad84af60542edfaa621aa93336d20ebbc75b37b23f804b5482e776

SHA512
2453b9d27f0cd68981161a83d1841119f0e99ef950fd4b0574dde8a6eacd08bf8d2aa16eb1afac574cdf5806f4c5ba1d8b74fe292328ac57f222e8ff5733de30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe

Filesize
468KB

MD5
2ad00d28d294be47246c449b98be67b9

SHA1
f50ef7dd426c305b53fa9e304a0c51b5b89d21c3

SHA256
d376a157f13efeed4cb34d4245281fab2c6b485ca7aeec7c3c4f065e901b73e0

SHA512
bb40b54c2188528de0776886a8bd18c6649d5d248fc7c5a179c99d6c21997f072dbcc38788aca95d8277f5ac126fddd53d9d2bf465ac723cf92f077fff59b4f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe

Filesize
468KB

MD5
746b816b5646b580d2bb4b6f617ff631

SHA1
e6d48bf9e7e0bd141067011981afcbd394cc0cc2

SHA256
5c73e901f031298eea915f9be7d4482a9a168d0bf14f8522c1ce9514bfce6a3b

SHA512
95d8f7960aecc08c732a55514e0a2fb745b88d6af42581032e229fe7484fa86777d39558a7bfa432327165a6f760953f5e7ed750d94467101aa12cf7cdcb7a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe

Filesize
468KB

MD5
93904ebbe6264cd7ebb37bc0ed8df88c

SHA1
0b68acef5450c7c0858b125ac64572711c867f0e

SHA256
c1c267cad4cf087e3a8f57a2254335d23adafd8814b9a3fef82ba6e684e217f4

SHA512
2377900183dfaaaa022c555f5fd5a64b603d6f48f9a0b8029d5f05e57f3bde647f9f53af422c35af1cf33187fbb60302e2e2ff00a82500ab12b241e7fd76cb21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe

Filesize
468KB

MD5
e6f293b5558035b63a604881bf0ba87f

SHA1
2348882c00ae665ea26b28d133fe77b522500f1d

SHA256
24b70cee38f59ec67f8d903bc5ce5ebb4faf1afacceab3265efc91e4dc73db4e

SHA512
5b53092e5de0e1deedfa2e4ed5321a1492dfdba44241f053eeea2ffe42aef431200541b7c50d5bdf422a36cf3381511d1400bd521f7ff7a614179841fc09a4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28538.exe

Filesize
468KB

MD5
28733fe633db53076c96ad916b54bf7c

SHA1
4207f8c583904988fc11ca8720e5216aa2a507a4

SHA256
cbfdd936846042c72cf4bed92cb66a536a825ad5a7059e6d53b4877d198b1888

SHA512
87bde29b56f6bd52e2a8c7bd66b7d933dba6702f489d17d65d02dca44d40f7013de3ea03df5ed418a1390519d557e600c514b9a033c6b897bab288522bbb91b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31696.exe

Filesize
468KB

MD5
8a3ee2bc9f443aedc18a8f4dbe2f1e59

SHA1
4b32dba94a855ab0ee5bf427564dd820cad2a67c

SHA256
1010ebba20473a1dedc504d79857377ff19d6eeec121eab2e9c36207411b4073

SHA512
20e1a97af507fe20e9fcbce04058190c28380d432502273ecddedb7a3b7352514427a2aa1ae9f8e193e0fd8a99f85dd3b3b1ccfa1125f70604789f19d54c92f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34406.exe

Filesize
468KB

MD5
2732f5bc1c104555048606e2860e81e9

SHA1
80aa49ecf5c85192a616adccd194e259b94e5c33

SHA256
2bf1c4b7c7ae5da07d0bc8f7e92465066ad1f809aa0a0140763acc623390726c

SHA512
fa532e30f22b8c8b10cf3e4e13dc63cac1417f874c75d70b4081b5c74911b1977986de31ff115fe709b931e2a849087f8231a85e252136b56cac7af5b89d7a0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe

Filesize
468KB

MD5
b03e524934030baf44cf7d85ae442e9b

SHA1
d47380e3fb3b0163beb9758b8da8527eddfe55f2

SHA256
f728766b351d1e1b84a35580133f8d85dcf4682b8069936bea3bda22f08962c5

SHA512
a501c78c24e841307fd0f9d58169687077833b274e2c0cf7952a9a82d23ba471f809846df042d36ed6f6a92476ef066cd5ab1e053ad871a09a3a6617835c58b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe

Filesize
468KB

MD5
49006a35f2dfa661be58348fa9667ee3

SHA1
2257fa700a4592cdab41600e439c16f45556fadf

SHA256
eae076c4cae1ee118a87c44a4610e7dec399c9c17e937371b9cfbd7d340cecfb

SHA512
702cc191f317d6f4272837cc18b5ccf8b564f768c3dbeab57ce3db3866864cc6d1cd45db1f3c37e864415df2521c69652cf6cfa4529d56af92624ac122e0bd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38298.exe

Filesize
468KB

MD5
347a4a9ee23c32cb4424758a4f23b561

SHA1
d11baf02976d369749aa942e4bee4fe2c72ef796

SHA256
8518411ec22de918a9d055ae8785d423fd86037b0fe698bffc1d1c63e473aac9

SHA512
e96a446f540d30c6c4f5635e575a3e1aba4e7bfb35213f71521c3ab47c8677d54e08a803b7e942cfa6fef71d23bb3dc309496614ac74e9144202c031a78e4169

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe

Filesize
468KB

MD5
8836edf801480f1613b8a1925da1f93e

SHA1
11d734c8e7efc4480ffbb4c6cde7b2012c941664

SHA256
1d3a3f1d8571cf2a35db7d74474fb0fff634e62c8d38b2365eb41c99fcb0b2a1

SHA512
a8ef6b55a99b14e92af559ebc7fc893952e6db50195209a2572e09961093c6f607deabffe3b5ab34f20a46fe09d572bc7f1f6904114d47650f7bdfab73a5c6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe

Filesize
468KB

MD5
d809f7a2bdddb8b7d487be1e4b9789d3

SHA1
377314fd0ee52f304bd86de4075fe86a6740d5d1

SHA256
25bfb52ebb917a3e6b2fe7a2613df6c3d014cd8b08c6361a27ed3f0e0304e968

SHA512
f745eab9d980cd75b3cacc5194eed1e9cc5ba84147c5946fbaf95a33e3486deb00a9eb7fe172f8e3f09cef42ac574d023eb73fc46548e65f5a194796b018dc98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40990.exe

Filesize
468KB

MD5
822e6e4050e6b37c99922026d7f88a3c

SHA1
5c649e28e28b2012e9bffd38a28587d1b554dac9

SHA256
c82ff05ec977fed65739379f445a424b936a3a888a33639ddcba130a6a73db14

SHA512
47a0bbb461e5001211d1194fbb50a04a6285abfd28bb5ac10e1ea59092541893ff56da63a88ecb9c0f24a7ef6a096e7882e3edab69570bb4adb86de0d0c9e13b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44320.exe

Filesize
468KB

MD5
62476e0ca0d617a277c6056756e8d0b1

SHA1
71527c9543518b1a7a42c19dee79ff78c88a218f

SHA256
0ee84f6ca0cc15878ab0bdd281d7f8bf38a8e4c82edbffa3ab378728a16e22ac

SHA512
3a3bd717a0ea78963c1124d8b771391de9bfc1a2122bb26a4fe54dacb1289ee8c3e0e088ccb7f8e8ec1688a548899b44458189522c8b4cb93031ea4f08f2ed57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe

Filesize
468KB

MD5
f07c36a7eec38d47cb678770f2d66115

SHA1
9cac6df95414fbf229d736494c1a7feba23c1391

SHA256
64e0f89ab5330cbc4adb3a5c86a02eb2ab147f1244db077ee2a6e1b1c75f053b

SHA512
970c2d099462f3c1261296b063f764808cc4aa983af37cb4921b608aff9f44b3df7b09950d10e2e443098f873306e21d5555817b5d5072fae5648656787d259f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47478.exe

Filesize
468KB

MD5
230b68185d131e316015ad2cc7566079

SHA1
ceaddf6d3a1be5c9d0cfac50efe66ed53a87f653

SHA256
8f82b23e8e60262e8c7e1bbb25d0e429cd1f11b1a025c77ec83b6de670d46507

SHA512
7fbbd45dd5d023fc95e824170e6e57c16d51487610d2bbdee62adf43cae7e43d13d029763d8d0f54b830d8b3ba98abece2d7ce8bd5a10ab2b04aa7bd8c4323c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47623.exe

Filesize
468KB

MD5
bc00f13d47839fe556fd0d624c70c190

SHA1
fffe9ba4637686854cad75f7d10991d686babe9e

SHA256
f2c1215db1a5149fa72aa9cfdf91a5638e97b20074f8be3e84052007a8f46366

SHA512
43a14fe586cda8876830f7dca891a6c87662c6c6e180b72feb6720a856922313537c2b37cc25eb9aeafb4eb1b340c5d7ba6003ae6c943985c8af63a1872e7917

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48365.exe

Filesize
468KB

MD5
b517ebfb0d90114cf139ad8912a5e2ae

SHA1
59d7c03f60a4b81eb3cd8cc3d466b544bed1b996

SHA256
ef3477db15d459d47b71144375c80a81361e08a64c0fe57a39d8a2a45278b969

SHA512
ad61d91979fcdb1495fe92ab12db15576ccc8af54af4bccbca9a93b8414503fa7098c5924304e8ab4e79eb5498a253d06982096f89fe53a5d282949d84f7a3fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe

Filesize
468KB

MD5
74cc9e2a990b60ad1a25e4660a0ac85b

SHA1
ab199abae84fa3ee5227d3553db199328779cfbc

SHA256
b3109b3201cc8b65590415db76551b2b8bc0b8abbbee85ef9d8028cf17b195ec

SHA512
4f40f5024ab49345ce5fb746d2c687d190e16c2c53614390409de969896f8bdf35ccae28bddddf83d66459e32ade388baa000be33783ed8085d88278d5c873c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe

Filesize
468KB

MD5
57c7f1ccda335116eeeaafe2dcafc651

SHA1
3dc0839dcb84e5adc3b6195c65d94dc874b5c5ff

SHA256
142433a78545780327d54ff1bbfda78b2ed145d4a3bd6a0c512436692c416f84

SHA512
71b63878cc980898ce6a5d787f91fcb20af3d8807c7343fa9e4e54f8bbdd7bfaf67738165a8fceefcee17691667036bad74c6dd147fbf7d22fd019fe06d61ecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe

Filesize
468KB

MD5
965d2a1ee91a82e6a694cc9ccc3b8790

SHA1
c1008ea68b19fbebcf0cdfdd5a0913964b3c129e

SHA256
77c305d73b1dfc76874b82b71fb627cdb26ded99e8e2319ce6bd762b4d16f13d

SHA512
c1c3c492015b400963010da5a7c042d7ebf3a2727e6c02cf24bb8e9fe18410fe948390c939567f83651e41d8dcf1c1471070ca421646bfa1950169d8ef9f0503

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe

Filesize
468KB

MD5
dd7989e9c908a9d2b75785d4452682b4

SHA1
c5ada5114466f0a1b5f89ad15a58eced1a2808a1

SHA256
693aa55ecceb590b77acef183a1b2625dd427ae18c2b3611ba2ececef30cca6d

SHA512
b8ffb0608003c932db82c684ee1303e9ac5aa8fc0d4f2144fabb5651631385b21b80783f3d8fdf1bdb1b5312721f8f712dc3bd41280675e25b01e4753a27c1c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60856.exe

Filesize
468KB

MD5
19e0354bbf7abdea479336ad2f057f3f

SHA1
045b6391d43e52eb793dbbbc17dc33ac4d845016

SHA256
43efd43332a3f8c0a9f0a62acd9793a82a8794a85416efe5be5a3f73a90fd74e

SHA512
2c7546847ab8d765b57c3b4f1ec6bb760d1d669f59c74c7af6aae77f12222510c31d189c02c78650a0902cf669765b0f79d9ac00a14d7181ae31596c65194a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61358.exe

Filesize
468KB

MD5
86d67c4efd0a3127a21946d047f6df9f

SHA1
a04b0fe9449f3349f1c5b63fe6196770ef7c3da9

SHA256
9f04bbf668e5171f5eb10080ea31e984b92359bec3808740fe32553d1e0b3fee

SHA512
c336fb20c09b0659cb05bac59a464fe2abd4334fddeb1e7633575cdd1049b36bda75f5fa2473d6ef84d41e220d6360eeadb5d41b399a2e7c72b5fbe706599dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe

Filesize
468KB

MD5
92effdf04283818e4679c23a1c59fe51

SHA1
d43b03fcc8b35ef92f4f1afc78a517dea440cdd0

SHA256
861cf53883ca2eeeb52161c49619b0472fa618807166924d2fc3dccbfc0d28c8

SHA512
05b8e53179af01cde1393d44200058336c56161d6bdce30a25adba514527ba0b57d489a0ec190cd37bc74d67048e3db628d3944768adc01982f5dd1f135135b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8318.exe

Filesize
468KB

MD5
e7d2c4a76d098e150dbe9a4ac8a9fcce

SHA1
cb238c3aeaf401a69cee6651bbe6619a7f0ec9f3

SHA256
52422037853fe8326717ebe6facf7cb2d7c88995571d2d9a6eef4000adc3bef9

SHA512
1121e273ae10f149e7704e1472bf4decc30af251fbb0d1b9ff9b559725ec65787f9826bb7aec3be2762c1a0c2f21621824172898d7174a615142ab667c7c846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9801.exe

Filesize
468KB

MD5
1dd3ca238758370f32b3f55c539b9733

SHA1
eff2bc5dd4e50ba105912c64881a31153e25924f

SHA256
b05d7e8477eaf99c5cf0ed9d8b85ec41d0ae548fa4caa19c08a67b22617263a0

SHA512
653ad747903e0af9ed19abca30594e96fd3d5177952ac220b335e99a1dded6f74196ee16ecfdb4a1412d7da5bb652cf66d9c925a3aaed24c58c6d7e60d89fb99

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads