dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe
Size

468KB
MD5

3a9d6281be1f3aa9c9342115f6d6d016
SHA1

6e947add3b1d3631408b44b0a0805eee9f593c44
SHA256

dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9
SHA512

f53b140df7a0da85a83cac882018e96185c382c2c00619752c257b399bbcfd6a12075feaa7272ebb0daffd4ad1d9b7a8c07b1ffebc6e7a0210eeb3cff352f424
SSDEEP

3072:aZxCokbrhlJCtbYaPn81Wf8/WChCpaplnlHCREhmx6XSAYyg+VEd:aZkocjCt1P81Wf/Smdx6ihyg+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4092	Unicorn-37136.exe
4712	Unicorn-1007.exe
4004	Unicorn-16886.exe
1492	Unicorn-20816.exe
3200	Unicorn-17094.exe
1896	Unicorn-20624.exe
1080	Unicorn-63502.exe
756	Unicorn-33504.exe
2944	Unicorn-13446.exe
3008	Unicorn-56192.exe
2672	Unicorn-6991.exe
1072	Unicorn-861.exe
1696	Unicorn-22871.exe
1588	Unicorn-3270.exe
3948	Unicorn-53600.exe
1568	Unicorn-870.exe
4728	Unicorn-37949.exe
4400	Unicorn-63614.exe
3056	Unicorn-17699.exe
4052	Unicorn-36112.exe
1560	Unicorn-35270.exe
1424	Unicorn-21504.exe
544	Unicorn-54368.exe
2468	Unicorn-5359.exe
4296	Unicorn-37767.exe
2728	Unicorn-17974.exe
4112	Unicorn-28909.exe
372	Unicorn-32586.exe
3764	Unicorn-37840.exe
4424	Unicorn-37472.exe
1484	Unicorn-33750.exe
3024	Unicorn-36896.exe
4128	Unicorn-15306.exe
4448	Unicorn-55536.exe
3900	Unicorn-7212.exe
1900	Unicorn-38624.exe
4748	Unicorn-22288.exe
2040	Unicorn-65166.exe
2868	Unicorn-18566.exe
5044	Unicorn-56807.exe
3572	Unicorn-34029.exe
1112	Unicorn-52967.exe
2836	Unicorn-26320.exe
3176	Unicorn-22406.exe
1068	Unicorn-25936.exe
456	Unicorn-25552.exe
4480	Unicorn-57959.exe
1708	Unicorn-41696.exe
3160	Unicorn-5302.exe
3452	Unicorn-25168.exe
3704	Unicorn-37974.exe
4548	Unicorn-40371.exe
2076	Unicorn-25168.exe
1820	Unicorn-57840.exe
1460	Unicorn-55838.exe
3600	Unicorn-59707.exe
4284	Unicorn-12038.exe
3496	Unicorn-30678.exe
2104	Unicorn-18749.exe
1500	Unicorn-4908.exe
3068	Unicorn-62862.exe
2292	Unicorn-3455.exe
3772	Unicorn-52464.exe
2232	Unicorn-19334.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2304	4548	WerFault.exe	143
5572	4548	WerFault.exe	143
7876	8028	WerFault.exe	318
8692	8028	WerFault.exe	318
17892	4436	WerFault.exe	876

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33505.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39807.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17512	dwm.exe
Token: SeChangeNotifyPrivilege	17512	dwm.exe
Token: 33	17512	dwm.exe
Token: SeIncBasePriorityPrivilege	17512	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe
4092	Unicorn-37136.exe
4712	Unicorn-1007.exe
4004	Unicorn-16886.exe
1492	Unicorn-20816.exe
3200	Unicorn-17094.exe
1896	Unicorn-20624.exe
1080	Unicorn-63502.exe
756	Unicorn-33504.exe
2944	Unicorn-13446.exe
3008	Unicorn-56192.exe
2672	Unicorn-6991.exe
1072	Unicorn-861.exe
1696	Unicorn-22871.exe
1588	Unicorn-3270.exe
3948	Unicorn-53600.exe
1568	Unicorn-870.exe
4728	Unicorn-37949.exe
4400	Unicorn-63614.exe
3056	Unicorn-17699.exe
4052	Unicorn-36112.exe
1560	Unicorn-35270.exe
2468	Unicorn-5359.exe
1424	Unicorn-21504.exe
3764	Unicorn-37840.exe
4296	Unicorn-37767.exe
372	Unicorn-32586.exe
4112	Unicorn-28909.exe
544	Unicorn-54368.exe
2728	Unicorn-17974.exe
4424	Unicorn-37472.exe
1484	Unicorn-33750.exe
3024	Unicorn-36896.exe
4128	Unicorn-15306.exe
4448	Unicorn-55536.exe
3900	Unicorn-7212.exe
4748	Unicorn-22288.exe
1900	Unicorn-38624.exe
2040	Unicorn-65166.exe
2868	Unicorn-18566.exe
5044	Unicorn-56807.exe
3572	Unicorn-34029.exe
1112	Unicorn-52967.exe
2836	Unicorn-26320.exe
3176	Unicorn-22406.exe
1068	Unicorn-25936.exe
3160	Unicorn-5302.exe
1708	Unicorn-41696.exe
3452	Unicorn-25168.exe
456	Unicorn-25552.exe
4480	Unicorn-57959.exe
3704	Unicorn-37974.exe
1460	Unicorn-55838.exe
1820	Unicorn-57840.exe
4284	Unicorn-12038.exe
2076	Unicorn-25168.exe
4548	Unicorn-40371.exe
3600	Unicorn-59707.exe
3496	Unicorn-30678.exe
2104	Unicorn-18749.exe
1500	Unicorn-4908.exe
3068	Unicorn-62862.exe
3772	Unicorn-52464.exe
2292	Unicorn-3455.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4092	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	82
PID 2588 wrote to memory of 4092	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	82
PID 2588 wrote to memory of 4092	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	82
PID 4092 wrote to memory of 4712	4092	Unicorn-37136.exe	83
PID 4092 wrote to memory of 4712	4092	Unicorn-37136.exe	83
PID 4092 wrote to memory of 4712	4092	Unicorn-37136.exe	83
PID 2588 wrote to memory of 4004	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	84
PID 2588 wrote to memory of 4004	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	84
PID 2588 wrote to memory of 4004	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	84
PID 4712 wrote to memory of 1492	4712	Unicorn-1007.exe	89
PID 4712 wrote to memory of 1492	4712	Unicorn-1007.exe	89
PID 4712 wrote to memory of 1492	4712	Unicorn-1007.exe	89
PID 4092 wrote to memory of 3200	4092	Unicorn-37136.exe	90
PID 4092 wrote to memory of 3200	4092	Unicorn-37136.exe	90
PID 4092 wrote to memory of 3200	4092	Unicorn-37136.exe	90
PID 4004 wrote to memory of 1896	4004	Unicorn-16886.exe	91
PID 4004 wrote to memory of 1896	4004	Unicorn-16886.exe	91
PID 4004 wrote to memory of 1896	4004	Unicorn-16886.exe	91
PID 2588 wrote to memory of 1080	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	92
PID 2588 wrote to memory of 1080	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	92
PID 2588 wrote to memory of 1080	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	92
PID 1492 wrote to memory of 756	1492	Unicorn-20816.exe	94
PID 1492 wrote to memory of 756	1492	Unicorn-20816.exe	94
PID 1492 wrote to memory of 756	1492	Unicorn-20816.exe	94
PID 4712 wrote to memory of 2944	4712	Unicorn-1007.exe	95
PID 4712 wrote to memory of 2944	4712	Unicorn-1007.exe	95
PID 4712 wrote to memory of 2944	4712	Unicorn-1007.exe	95
PID 3200 wrote to memory of 3008	3200	Unicorn-17094.exe	96
PID 3200 wrote to memory of 3008	3200	Unicorn-17094.exe	96
PID 3200 wrote to memory of 3008	3200	Unicorn-17094.exe	96
PID 1080 wrote to memory of 2672	1080	Unicorn-63502.exe	97
PID 1080 wrote to memory of 2672	1080	Unicorn-63502.exe	97
PID 1080 wrote to memory of 2672	1080	Unicorn-63502.exe	97
PID 4092 wrote to memory of 1072	4092	Unicorn-37136.exe	98
PID 4092 wrote to memory of 1072	4092	Unicorn-37136.exe	98
PID 4092 wrote to memory of 1072	4092	Unicorn-37136.exe	98
PID 2588 wrote to memory of 1696	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	99
PID 2588 wrote to memory of 1696	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	99
PID 2588 wrote to memory of 1696	2588	dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe	99
PID 4004 wrote to memory of 1588	4004	Unicorn-16886.exe	100
PID 4004 wrote to memory of 1588	4004	Unicorn-16886.exe	100
PID 4004 wrote to memory of 1588	4004	Unicorn-16886.exe	100
PID 756 wrote to memory of 3948	756	Unicorn-33504.exe	103
PID 756 wrote to memory of 3948	756	Unicorn-33504.exe	103
PID 756 wrote to memory of 3948	756	Unicorn-33504.exe	103
PID 1492 wrote to memory of 1568	1492	Unicorn-20816.exe	104
PID 1492 wrote to memory of 1568	1492	Unicorn-20816.exe	104
PID 1492 wrote to memory of 1568	1492	Unicorn-20816.exe	104
PID 2944 wrote to memory of 4728	2944	Unicorn-13446.exe	105
PID 2944 wrote to memory of 4728	2944	Unicorn-13446.exe	105
PID 2944 wrote to memory of 4728	2944	Unicorn-13446.exe	105
PID 4712 wrote to memory of 4400	4712	Unicorn-1007.exe	106
PID 4712 wrote to memory of 4400	4712	Unicorn-1007.exe	106
PID 4712 wrote to memory of 4400	4712	Unicorn-1007.exe	106
PID 1896 wrote to memory of 3056	1896	Unicorn-20624.exe	107
PID 1896 wrote to memory of 3056	1896	Unicorn-20624.exe	107
PID 1896 wrote to memory of 3056	1896	Unicorn-20624.exe	107
PID 3008 wrote to memory of 4052	3008	Unicorn-56192.exe	108
PID 3008 wrote to memory of 4052	3008	Unicorn-56192.exe	108
PID 3008 wrote to memory of 4052	3008	Unicorn-56192.exe	108
PID 3200 wrote to memory of 1560	3200	Unicorn-17094.exe	109
PID 3200 wrote to memory of 1560	3200	Unicorn-17094.exe	109
PID 3200 wrote to memory of 1560	3200	Unicorn-17094.exe	109
PID 1696 wrote to memory of 1424	1696	Unicorn-22871.exe	113

C:\Users\Admin\AppData\Local\Temp\dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe
"C:\Users\Admin\AppData\Local\Temp\dfac372235043836ea7d020d40fe05b3a017519acf55d6f15a6a9ae199b0d3c9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1007.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18749.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15665.exe
        10⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        10⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        10⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        10⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        10⤵
        
        PID:18268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
        9⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28641.exe
        10⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        9⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        9⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        8⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        9⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        10⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        10⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10948.exe
        10⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51688.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        9⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        9⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10977.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14215.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36705.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30678.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20384.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        9⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        10⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44136.exe
        10⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        10⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        9⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        9⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        9⤵
        
        PID:17452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        9⤵
        
        PID:18256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13709.exe
        9⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29576.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57842.exe
        8⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23629.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7149.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        8⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55976.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56946.exe
        7⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11338.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36720.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        9⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24081.exe
        10⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        10⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45212.exe
        10⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        9⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        9⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61906.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41790.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47201.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43095.exe
        9⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        8⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51071.exe
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47848.exe
        7⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49005.exe
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6844.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18404.exe
        8⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46581.exe
        8⤵
        
        PID:17852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47400.exe
        7⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
        7⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47140.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
        7⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4775.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36896.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3455.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21920.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24689.exe
        9⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59953.exe
        10⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        10⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44463.exe
        9⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7415.exe
        9⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8206.exe
        9⤵
        
        PID:18128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7101.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63640.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54356.exe
        9⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65106.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        8⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3590.exe
        7⤵
        
        PID:1076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5376.exe
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43591.exe
        9⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        9⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46487.exe
        9⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        8⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        8⤵
        
        PID:18188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        8⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20017.exe
        8⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63768.exe
        7⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54532.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36460.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        6⤵
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55469.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        8⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47403.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        8⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48210.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        7⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53237.exe
        7⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17325.exe
        6⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11248.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46763.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34814.exe
        7⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5150.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3943.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52464.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64031.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32302.exe
        8⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7379.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50815.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3782.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        7⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25502.exe
        6⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60884.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38237.exe
        6⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        6⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19334.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38256.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63428.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18439.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51461.exe
        7⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61627.exe
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41260.exe
        6⤵
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        7⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50619.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
        6⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30775.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57476.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46252.exe
        5⤵
        
        PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19901.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13087.exe
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        9⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        9⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        9⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        9⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25883.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5837.exe
        8⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14336.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        8⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43838.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        8⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1143.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27873.exe
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39827.exe
        6⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7311.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        8⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12206.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2263.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13575.exe
        7⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6765.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61617.exe
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-340.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42136.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58015.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59073.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18566.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24992.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6995.exe
        9⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        9⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59746.exe
        7⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
        7⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        7⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42799.exe
        7⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52991.exe
        6⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50696.exe
        7⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9406.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        6⤵
        
        PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3018.exe
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62577.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49768.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        7⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44287.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        6⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63668.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        6⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        6⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33470.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41479.exe
        5⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58541.exe
        6⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12499.exe
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16868.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42135.exe
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40872.exe
        7⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        7⤵
        
        PID:16188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44389.exe
        7⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51183.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        6⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32186.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32810.exe
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61039.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        5⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40311.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56807.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60160.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45489.exe
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62751.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44412.exe
        6⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64408.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        5⤵
        
        PID:17532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39773.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
      4⤵
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21809.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57185.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
      4⤵
      PID:8028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 464
        5⤵
        Program crash
        
        PID:7876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 420
        5⤵
        Program crash
        
        PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12214.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12214.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7277.exe
      4⤵
      PID:6648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64887.exe
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45758.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62696.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        7⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23182.exe
        7⤵
        
        PID:16496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39438.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39807.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41861.exe
        7⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39832.exe
        6⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11549.exe
        7⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34196.exe
        7⤵
        
        PID:18368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41487.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9680.exe
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        6⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38145.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6099.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
        8⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34241.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41214.exe
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        7⤵
        
        PID:17568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        7⤵
        
        PID:18240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25352.exe
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        6⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54331.exe
        5⤵
        
        PID:3552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57871.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40488.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        6⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1367.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:15520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41125.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65295.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3639.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        5⤵
        
        PID:17484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
        5⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38624.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9148.exe
        6⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25089.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        8⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62670.exe
        8⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24868.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        7⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47304.exe
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49647.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13463.exe
        6⤵
        
        PID:13896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        6⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29021.exe
        6⤵
        
        PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40979.exe
        5⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9055.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30865.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45055.exe
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54219.exe
        6⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        6⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        5⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13584.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        5⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6429.exe
        5⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        5⤵
        
        PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43248.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25873.exe
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        7⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16954.exe
        6⤵
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        6⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        6⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41880.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        5⤵
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        5⤵
        
        PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
      4⤵
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58832.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21802.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29182.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1015.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53602.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23070.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        5⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59025.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20595.exe
      4⤵
      PID:13944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9494.exe
      4⤵
      PID:17444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29973.exe
      4⤵
      PID:5628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29792.exe
        6⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5472.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14720.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58197.exe
        8⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57320.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        7⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57534.exe
        7⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        6⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        7⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
        7⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31396.exe
        7⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1982.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
        6⤵
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        6⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22036.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32230.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22145.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        7⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45471.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50801.exe
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17092.exe
        6⤵
        
        PID:18408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7847.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
        5⤵
        
        PID:17648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        5⤵
        
        PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35568.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21460.exe
        7⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58056.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        7⤵
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1091.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5111.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        6⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56110.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2746.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:17460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
        5⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51317.exe
        5⤵
        
        PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19815.exe
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55620.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        5⤵
        
        PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34734.exe
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      4⤵
      PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
      4⤵
      PID:17660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
      4⤵
      PID:3208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26593.exe
        6⤵
        
        PID:12688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38325.exe
        5⤵
        
        PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34401.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        5⤵
        
        PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8062.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      4⤵
      PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
      4⤵
      PID:1184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48964.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        6⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3431.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22865.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
      4⤵
      PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13712.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58616.exe
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3025.exe
      4⤵
      PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32872.exe
      4⤵
      PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
      4⤵
      PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18637.exe
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42390.exe
    3⤵
    PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64257.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17431.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        5⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
      4⤵
      PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:15584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43201.exe
    3⤵
    PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5075.exe
      4⤵
      PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60504.exe
      4⤵
      PID:18012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
    3⤵
    PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61187.exe
    3⤵
    PID:14224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30663.exe
    3⤵
    PID:17712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
    3⤵
    PID:2940
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16886.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16886.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50212.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52632.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        7⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        7⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37512.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42298.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52815.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26698.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        6⤵
        
        PID:18104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5894.exe
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57389.exe
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47393.exe
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        7⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45371.exe
        6⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        6⤵
        
        PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56158.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62961.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31038.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7242.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5166.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43543.exe
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65166.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58240.exe
        5⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23456.exe
        6⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12432.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61935.exe
        7⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38295.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        6⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54513.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9838.exe
        6⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7517.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        6⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1377.exe
        5⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56113.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
        6⤵
        
        PID:18356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42661.exe
        6⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-682.exe
        5⤵
        
        PID:17952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
      4⤵
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13279.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        6⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22535.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61631.exe
        5⤵
        
        PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36834.exe
        5⤵
        
        PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
      4⤵
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42017.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48351.exe
      4⤵
      PID:16832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26320.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34065.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53352.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37720.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32353.exe
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21338.exe
        6⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42982.exe
        5⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7491.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14480.exe
        8⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59512.exe
        8⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        8⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
        7⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28558.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6871.exe
        6⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27668.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23032.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13959.exe
        5⤵
        
        PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4950.exe
        5⤵
        
        PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12303.exe
        5⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34408.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        7⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57150.exe
        7⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39255.exe
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36539.exe
        6⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38245.exe
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56712.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29473.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:16144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44875.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        5⤵
        
        PID:4436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 84
        6⤵
        Program crash
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42100.exe
        5⤵
        
        PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5213.exe
      4⤵
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64305.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41535.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50693.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32164.exe
        6⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35538.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46539.exe
        5⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8532.exe
        5⤵
        
        PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42187.exe
      4⤵
      PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        5⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        5⤵
        
        PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14366.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
      4⤵
      PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
      4⤵
      PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27680.exe
        5⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28272.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63345.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32471.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28859.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40599.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61583.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
        6⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22372.exe
        6⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
        6⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51759.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28840.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28657.exe
        5⤵
        
        PID:17512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8196.exe
        5⤵
        
        PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59127.exe
      4⤵
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11594.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        5⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33079.exe
        5⤵
        
        PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31246.exe
      4⤵
      PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32298.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38357.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        5⤵
        
        PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5718.exe
      4⤵
      PID:12352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
      4⤵
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        5⤵
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62769.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49083.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28846.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58856.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10195.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28142.exe
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8583.exe
        5⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17217.exe
        5⤵
        
        PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6359.exe
      4⤵
      PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10640.exe
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        5⤵
        
        PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17166.exe
      4⤵
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
      4⤵
      PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
      4⤵
      PID:18284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23286.exe
      4⤵
      PID:10396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
    3⤵
    PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
      4⤵
      PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
      4⤵
      PID:13276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:15428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58808.exe
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65249.exe
    3⤵
    PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-985.exe
    3⤵
    PID:14236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26463.exe
    3⤵
    PID:17612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
    3⤵
    PID:6020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63502.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63502.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57840.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51712.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        8⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33534.exe
        8⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        7⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        7⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
        7⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        6⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10256.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        7⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37535.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30568.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        6⤵
        
        PID:17700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54901.exe
        6⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        6⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58129.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14464.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9735.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24746.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35976.exe
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33214.exe
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
        5⤵
        
        PID:18328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3676.exe
        5⤵
        
        PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12038.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46001.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        7⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27915.exe
        7⤵
        
        PID:17656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38910.exe
        7⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        6⤵
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59404.exe
        6⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44184.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24894.exe
        5⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
        5⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        5⤵
        
        PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13319.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14510.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:16880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
      4⤵
      PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12960.exe
        5⤵
        
        PID:14120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17722.exe
        5⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25425.exe
      4⤵
      PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3731.exe
      4⤵
      PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65092.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44222.exe
        7⤵
        
        PID:17892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44264.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
        6⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62783.exe
        5⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10608.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        6⤵
        
        PID:17676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16429.exe
        6⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2362.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21652.exe
        5⤵
        
        PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8704.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58488.exe
        5⤵
        
        PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45839.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        5⤵
        
        PID:17404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        5⤵
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47007.exe
      4⤵
      PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
        5⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45596.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43400.exe
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
      4⤵
      PID:14296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36263.exe
      4⤵
      PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59707.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53165.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25265.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24126.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5899.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23325.exe
        5⤵
        
        PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31735.exe
      4⤵
      PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57480.exe
        5⤵
        
        PID:13840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        5⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57147.exe
      4⤵
      PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24702.exe
      4⤵
      PID:15096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      4⤵
      PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48839.exe
      4⤵
      PID:7416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51063.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54699.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26782.exe
      4⤵
      PID:2564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      4⤵
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
      4⤵
      PID:10148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10465.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
      4⤵
      PID:15936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18199.exe
    3⤵
    PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22816.exe
    3⤵
    PID:14308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
    3⤵
    PID:17624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    3⤵
    PID:6056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65160.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64431.exe
        7⤵
        
        PID:17336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31614.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16737.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44952.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31239.exe
        5⤵
        
        PID:16256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47991.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64865.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57519.exe
        6⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29694.exe
        6⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36295.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2884.exe
        5⤵
        
        PID:18112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8333.exe
        5⤵
        
        PID:10716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53551.exe
      4⤵
      PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30241.exe
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49144.exe
        5⤵
        
        PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9767.exe
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57729.exe
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        5⤵
        
        PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44658.exe
      4⤵
      PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45095.exe
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12879.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8928.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        6⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5194.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3214.exe
        5⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        5⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17511.exe
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16938.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44060.exe
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55246.exe
        5⤵
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
      4⤵
      PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      4⤵
      PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
    3⤵
    PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60193.exe
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11050.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        5⤵
        
        PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3815.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39010.exe
      4⤵
      PID:14020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
      4⤵
      PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35940.exe
      4⤵
      PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27876.exe
      4⤵
      PID:9764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17594.exe
    3⤵
    PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64719.exe
    3⤵
    PID:7852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5450.exe
    3⤵
    PID:14196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53329.exe
    3⤵
    PID:17692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12195.exe
    3⤵
    PID:4592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25168.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
      4⤵
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20932.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20103.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        6⤵
        
        PID:18116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46414.exe
        6⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43111.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46125.exe
        5⤵
        
        PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64699.exe
      4⤵
      PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37466.exe
      4⤵
      PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33299.exe
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40916.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46561.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57957.exe
        5⤵
        
        PID:18416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
      4⤵
      PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24238.exe
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32417.exe
    3⤵
    PID:11668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61575.exe
    3⤵
    PID:17248
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 464
    3⤵
    - Program crash
    PID:2304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 508
    3⤵
    - Program crash
    PID:5572
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16288.exe
  2⤵
  PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    3⤵
    PID:3740
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57449.exe
  2⤵
  PID:9388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20159.exe
  2⤵
  PID:13640
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
  2⤵
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4548 -ip 4548
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4548 -ip 4548
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8028 -ip 8028
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 8028 -ip 8028
1⤵
PID:7820

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1007.exe

Filesize
468KB

MD5
c5a8038dcbb92501ee98eebad2d25b75

SHA1
1c1442f1ea1e42d6c8c2c1a3282d067fa63f8331

SHA256
932e1f48794c618fab0668f2bf604804f08c52dd9751cdbf15431ed009cf8d70

SHA512
31ae73e7f18f0b913bef4bff5e52f2ef55b2a086e1fad45125cedd0d6a2368f7daf1a9a7a43d8e9819e675c88b6bb689a54aa3424eeb424278d316f9f72126c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe

Filesize
468KB

MD5
c839ab93775b82ae65dedcea6326e24a

SHA1
6ff3ee896af7310badc9782c5a1ab7739c96333c

SHA256
477cf8a825fd28e07a394bbc2b7c291e202f1f02fb70234d0c14ef83215ece59

SHA512
f07f9c0f364b8532f18c23c7a9e9cea7240f41b8c9f5c399e3859e058b51fd53d1b1c1da3ee037595adcae6b762b348a5a051bcdc554b8af8fd7304760204834

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16886.exe

Filesize
468KB

MD5
bce6a2cb6f7d6a57c8ee1a8821c6a06f

SHA1
ce183a84d480a95571da7e937d1066a1502a9e3d

SHA256
bcb9a7fb46aa27447b108525ab60c7aa9db96e39effe2604f840072d9f8d54b1

SHA512
5d83b729d0f09342119e8240c73f4037cc5339a3dbfe985044d3a976ca36762383e0a04f991aeb712e9a10f62107806cd5aa0986039ca2eea9d73289772296d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17094.exe

Filesize
468KB

MD5
accd2eaecf9b08c98ba8c94ee7c45307

SHA1
1692004186bb0048a32547fb97da0eae01ef6c7c

SHA256
a0dd35a7e94b5a9c7aba5c45ccfea74e7071f46237d0c9f66307f1d8ef1f39e3

SHA512
58af2aaa53be9da0abf8f8c1c0fcb0af8f6ebda5d2d1022b574c69cc240ba7b30bd24596632bd3a7181c3d8b44b8ce445e911f122d92fc64a4361ec97ee4ccda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17699.exe

Filesize
468KB

MD5
fd85fb6998f60b7dc92ce9026cb376f5

SHA1
c39d2ed6fb80987002524ffbdd9538eef11e89a1

SHA256
8d98181070902a71b50c6f2e4e3c0ba695740305cffc976908b87f6aaa860193

SHA512
82e5f28ecc2697fba2b5973cbc06209455ea2e65a3b7d67a04f70fdabd715229ee5dced9e30c874124008b534647586e2f031128e8220ec5206ca062c5e196b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe

Filesize
468KB

MD5
e9ab195f8468d35d1ebd14420b448f29

SHA1
27eef4e5e3f156a4da7caac71b97697c5e6b89d9

SHA256
ba079f71ae58b379fc60886e7d0f6b403e329d261494dee702b10c1c45712768

SHA512
0717da7cf6fc4292c25353a68a338118d538b1d987cb14812b678a060ea4f65d7f355a3218c561f771505cb864e7b06442bc62e0f61c3046afcd940d85c7cc26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe

Filesize
468KB

MD5
2e82c7f51237b4ede91842f82aa5a588

SHA1
8be60292b8de4495499d69d05295e4fdb817e58b

SHA256
6e5bc690a7ee91651e0a23e05413357a10f7694f32d79973feef40943c142968

SHA512
8305beb33a67d240ff2b7aa4dec45fb32b055a858ce5ed6fdb61dfac631b7b0cf8a010e35786b94767c6a459a8d693ec2639478b00ed0af02f0003a16771c1e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20816.exe

Filesize
468KB

MD5
bcff5048cec7afbaea5c428969b75f65

SHA1
bf2e6592ebf777f1b0227adfc32238e7f4bc4d60

SHA256
774071159d5e9f8f858ab675147ba6131ddf1119d196faa3a49b14b7f0f34b64

SHA512
e86a6c04ead71343efd2ab1d32a36c51d756b358eb8695c96c18e3375520cffdc4d67979e574e0f6c6cc709c4085138ca7174d2567ad715f92e57a488069e605

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21504.exe

Filesize
468KB

MD5
fbb86b3afdc16025b3d72cdadc8b8207

SHA1
e05baa51d2a58768a6784f5f811b58fd0ef53603

SHA256
ab3b56939de24372aa151316a1a19f94209478c5a6be12ef01b62eeb89737211

SHA512
fe3c8f040b341c9fd3c22f458fbea1c3ed6c3abd8014134c365f8d16acfc4cc35db62d540a7785a618e735a4a7ef629e8ec5d3ddb37d6af133ad6c0c6de3ee88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe

Filesize
468KB

MD5
e59b1b1a818bedc91b5cde4b1f456acf

SHA1
a0e434ab403d3baa937e15b73cda721951ce355a

SHA256
0ad2b6bec1f3d0d7f9710d5de18dae48a0b8d69054cea8b64c681a6f2ae9c8db

SHA512
b726501b11c2f5476a75bb3f3101b9c428d31aa566a1a8482d20a48865a72b518611a73003def1065193a1c8acee6f959238ee7f2574431c3a72134c0e92b7cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28909.exe

Filesize
468KB

MD5
2de3b0f4e53d8369e3cffbddd379174a

SHA1
e112b584567b335b7908f13e0e49516239fb1fda

SHA256
08c87f5efce02635538783dc44da2b157a11290feb4abbd21cfe7fed07805189

SHA512
e7f7db4a4e8b95a9ba52c334297623ff82f87a8269f39f3d7f24a963387011a47b7c98fa01e4ec38a2140625988c96d5ceb2c7f25862da63142316cc4955f859

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe

Filesize
468KB

MD5
0a92fb50e47055dd993b069630cdfdc9

SHA1
833cb214e680d3e741a4a1425b6d5cdf97c31968

SHA256
94eb0fb581ba96f5eee463dff893f73b249500cb7a524a032be8a16cd74da655

SHA512
36e5436f2d43e52371a91ae65f1b53df6860934f8dfc2ed1d43d89caa32b6768c77cd245fddb0495dab4200696f0be6cf340dc260d5eae40f5d4f80b578ede33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe

Filesize
468KB

MD5
29841d716c4c638ac6a2a6589049cc19

SHA1
5cb471c92f8163c734f628a9a393ad23c79e080c

SHA256
ebf66d119691ba5993b4f5527252cd5f2bdca68f773f8b0640c42428df6255b8

SHA512
1b6c6d7e3c4594f8f57ddae82c7b2de157ad31dcc9e54123ccb740a817642dacb148d45d3ff3ae454e33bb15c246980047e7998a2ee4f9d3c215b80133f39930

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe

Filesize
468KB

MD5
025f5dc5971698cf342b7ef05eeb33ef

SHA1
c87a1b6dc351f495c2b3228cf7df652f719e9946

SHA256
1e589cfae46ec98e143088fef320c30fe53ee3e8abac44480d9c21204e6508c2

SHA512
efcbd5ae223028e769dd1aef4c9003662ac6e4a323ae4d623db56cfffa3839bde52355279763277b4c0a39c1e5e6f592846748c83754471a4f30e0c8e5bcbafc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33750.exe

Filesize
468KB

MD5
eeacdbf4bb3f620f6374378f44d9a31f

SHA1
80297b567168164eee35873a30ef9e35b8ea6be8

SHA256
9fba75aad53b663dae399ae4b80e0d0b47973ef43e07e3cdcd2f99bcf7ee7268

SHA512
7c6acd444c3e4d1dc90a650b9bc95893e10889bb30fa9da7ab5bfdecc501010bca75d3ef2fa9d5e23acc25c6e988513656de2d167bd573d198dc3eea49887e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe

Filesize
468KB

MD5
6f7039434f0dbf03cca181fc23fc7b90

SHA1
6756d1833fdd596592d66d285508bd284cec8cf6

SHA256
7da7996e4b25db13b89204af499a148fe9a25c452a0ca6c8bb190a75d058f406

SHA512
516cacc36ada63b09fa75d3732433688e501466cc6838daa0965e989336756d39fe6efcd895117040cdea2d81993b2a398dea06448a2018e6e76728c939bcdce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36112.exe

Filesize
468KB

MD5
9fb7b26e37ca5367c85c82ba83f2b584

SHA1
81028405642fcc91c08c041f1ed66a67ee1641a0

SHA256
a0915b19c65d6ba918c679c3f981f8bd2ba4bd252961500a719be3628ac849bb

SHA512
05f284dce1341c574df772f49eee12eabf1b67eb9d195e2e378eeb686b7556d83a7f7c0892a1e1dc7a496915d97696f281a6a152ee894a5f110e2fb695837bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36896.exe

Filesize
468KB

MD5
f20a650e891c2d8ee6f54fe53f2af064

SHA1
f8453609806a65d2b79f55c30a2ccf23c4489edd

SHA256
a9f74918d6f5a1b5351378cf1bc6446663487ddce83da6030bd99840f731cd4d

SHA512
2ea3e49f7acc0d4ce4e366de4179c06f40cc61f541218a7de210112923fbc55c6e1f3a866ad2aa93877302b10cbed541e0ea78d4b69da0664d48e76bd580b90e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37136.exe

Filesize
468KB

MD5
0e4f40378d24f42d9af52b02214cbac4

SHA1
e41bc94d16c51a87e3ef360ecdac13d5936f99c3

SHA256
34c540206bbef07164e51693d5fea40f290038bb7949f902deeaa80ecdabcd55

SHA512
e7115c5a9fcb8d252e887d3b92da2106f1bfb22804dcbb0d1108f7295a725561d553b0b604972b86a130eb27dcd6e08d138f54a3b6d70f8971688c4f35999c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37472.exe

Filesize
468KB

MD5
a0c155c183197042678383e73acbfe96

SHA1
05295bfb62fcc795d09313f970f57c9d9f28ae4b

SHA256
51066b2410f9c73b3fc1b48953fe6dd3e94d5dd7fd08676953e65ca1e750b26c

SHA512
db16b65a744f04ebbbacdd9dd5d1a29918573a498fcf66980bc7d4e0baab2fbee7be8382b64b3a3043a7eca27dbd95e552a811756f7ed5e7547d4a6552a4df13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37767.exe

Filesize
468KB

MD5
0cb7c5902a01dea5a4ae93a19aa81690

SHA1
28812a34c285c1a492a6173cd3a0f4e3c9bca9bd

SHA256
12aa7ce2b13e83b046ae48985775c552113a25dd52c84f20a865e81264296301

SHA512
103b64e661e5f8378ce38b57bc76fd4eeaa675b98c541b7e40982c39ec8b21d383272859865e2c475a5324a996cbb7e2075172e770c1ac2e5d61d03f51ad72dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37840.exe

Filesize
468KB

MD5
fbb7402fdf8f00771b99598f85f85d55

SHA1
f39e8688fe10a57a218b02b4760065f2dd6f67b1

SHA256
c53436fc752463e4e537e75dba9a6979a7c359c0b037fe663992323a33720295

SHA512
8f188871e5bcbb482bd08decab584ecc70f38e1a81050d76694333737a96af2577fc5b99dc38dd213c84e574a830217b535b6adffefd7f205ef1f9878d38a98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37949.exe

Filesize
468KB

MD5
4b2ab4111edb6b3df54acca22a1a541b

SHA1
82715f184456073d31653b3a57b281c9a9d5179d

SHA256
02520f9ed5821c0c9de705db462b5545a76c84e3a72cd5a1f07cbdd930d1b02b

SHA512
afb051cb492b840dc7fc797a6e92e613248c61a69cadccb8569f637e61737d1a3a6dce8bd95f1db45f8d5c26c886e53a0177c383eb5b255242ee2967eeae2343

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47128.exe

Filesize
468KB

MD5
e78c62d1b95ca37aa1f5ec781ed7e521

SHA1
cd284a9c2faff48127f600a4ebd473c08aeb4b96

SHA256
4c79560508eb32fb56221e255d9614e20fa04be91f97620f2e5e88b2646bae31

SHA512
b0bdc7056dea0719431024679cbfe7385541aaa2552c4a391e70520dcac5d3c4338135a4c05b72bd5d9836e0d86162e84a9f93a42ed4a12ccdfd705d3ae325a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5359.exe

Filesize
468KB

MD5
e1caa3951a9d83bbd0bc0dd7f5b1fd3b

SHA1
7a4fbe8470de9bf92d1244baa20d2fb080ed381c

SHA256
62386fb1be69215b4463cf354d94ebe291e45d24304663e0d082bab9953eee7a

SHA512
f9029f8204205554f8f316f1f4f5eaa763f8ca16044f5b2f4e9454a2a15265b41c7c5b6419192d4f2096fbffe8721c196ce6dc8f5a05e2cde723a4176ba62da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe

Filesize
468KB

MD5
ddc6c3222740c1be69f3085ed0961c41

SHA1
c8ab9ff71e48381b2d4d58dbdcca748b403b445e

SHA256
ffe36e7a6048100950acbbe5eea0a109955771bd2283ff16e896a479e5cac293

SHA512
59942f56443a0f0effa99c26db45e80ff7ee585a82a80fd8f6f83a9ee91b8f39dc98109ab848249e1f637ba1460d5944dde1561dfc9eed349fdfd8d455f678b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54368.exe

Filesize
468KB

MD5
5c6c7c35fa92909547baf7609235a490

SHA1
111986156b59c4b75dd6952bab713009f0612ff8

SHA256
9f62d1348e96b69a721d1ec61d963a2905c9813643211a8221af8cf3d52cd071

SHA512
dca5488643fb5c5619df7cc06a0381f95ea0607932f0c312e4a3173c48a4cc1e3ce50dc29796dd44997daeb25514470438a7d7e5835a26aa8d490ab46d2e2aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56192.exe

Filesize
468KB

MD5
1e1a925c2b26356027ffba37ec9b2d98

SHA1
8f72b640cec325647128b0361627801b4893fde5

SHA256
05c0765a15189f6f6f8278298e424d218ac4a84fb5c28f460a1afb3052d703af

SHA512
c1064556c4c388bf7bd11a13e4fe4d1b1bbe2f0086f2b692e72ecae7ab3f3f9ed2c196a1347b1c1b5aad1f1f8b61b629a0550e24e28260071aa0bd542a5457ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58197.exe

Filesize
468KB

MD5
2e449d69c3b1dff8db5d32bc31bc3a18

SHA1
7d218054c261150d112aabafee24fd6a4dc28d4d

SHA256
51c99b3a23e643a54a9a988d70c9f7df7b0cfafea65c505abce8fd476437b23a

SHA512
b7f270b7faf6614912d713ed385e3b4b355e2678eb7bc97a6572acfa1830fa54348968410438a850ceeb9442105fe51b214a0355783d761ec119663412e30e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63502.exe

Filesize
468KB

MD5
59a5834234d91e27a2f2aa4e312ac97c

SHA1
4a01bceb52adf98566e3f7aaaf855547e5e5359a

SHA256
7f354c75676cf1ee9011eb4e256f0212421c845ba3e2e2b4c729ba4ecdfda8b3

SHA512
4587647cd8303febe7041cbc4da660eafb65f978df7e12818cf42077b5400fd5403f79fb32cfec3b7c4c8309e63ab3eccadbd24683cddbcb868256d1cb2467fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe

Filesize
468KB

MD5
8aa874f5f682e547ac57f1af43a0eb19

SHA1
19867c270b10299e0d2bca26cf0302255c6c53f9

SHA256
b761dbe02a3b0ec175e9c0b6d98efa2b56003b7872950d7861964716549d6990

SHA512
937d35bd325e91e538d62123b14abe7e074f33328f58a2806fd01348308cfbf45587d4063e32eee3817e070b177e05fbbef66ec0dcadc7da233f32332b3e5e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6991.exe

Filesize
468KB

MD5
1debdb629eecd03f043a4f21cc650429

SHA1
4361156d6fac13286301e8f2e48c11e7ad1f08d7

SHA256
297c3b8cabf3a3916c60b9b7a5f19383e4ec2350612a7673eed9837dbb1d3e9a

SHA512
a524c70ee615606a2e8374a52ea3141eb039dbcf25ec52f7c32b11e2e970d258b1f7361a9341ba7e46de16f75c6b740d854e18beb2366b50e87b5de9309e9c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-861.exe

Filesize
468KB

MD5
594568920c046c44d325453bb5947c0c

SHA1
5f007dbd9021e8b2969c3afb29f1a7c22c3284be

SHA256
97c3ef51174f6ba6837c8a5307d4eb2a131aacef3cea98a368dd7eeff9167ecb

SHA512
9bda5f6ae67ca45fe48a856a1c70aa38edcd751fa2e07169022532af05dd86d0779a8ceee086f93b6c7b89904cc99372425cdc668f3bf27c643ef1212f5a29ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-870.exe

Filesize
468KB

MD5
4f65cdb393baa9a2992a39bfd6ffc941

SHA1
7c5a5ec6db933281213d30953bcb8b38fbbbf563

SHA256
f37cbc74d55c29a06bd55cd475e5d9458810957cbf7fcdc02c6352d6fdd3ba90

SHA512
8ae0637879e47b00e8cda440970678bf221b8b6c90cb0a2f572affbd8f10ad712994c8f0b9281f4a33fc9b961582313de4cdd76bd8782fe8dea968998262e6dc

Download Submit
memory/11416-3217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads