ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4e

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe
Size

468KB
MD5

8d8e7588a9c0942365702616879149b0
SHA1

3a27e6656097fc45362df2a6ca8ea9aa56b9c9e5
SHA256

ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4e
SHA512

a74ab8e13bc077abcfdd59110658f82bd9fa509ae7c3671c42e41e743b945e8a26e3e4e8a7034271e61e9a9322af264bfeb836782cba994041995bc976c8a768
SSDEEP

3072:auChogfxRg8U2bYZPz3cqf8/EC3jyIgZswfIfV8pUku+rvzcttMG:au8oCNU2aPDcqfRVQyUkpbzct

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3204	Unicorn-4540.exe
1912	Unicorn-19289.exe
2936	Unicorn-56792.exe
2872	Unicorn-7249.exe
3416	Unicorn-7249.exe
60	Unicorn-36999.exe
1184	Unicorn-23263.exe
4928	Unicorn-45625.exe
2716	Unicorn-35411.exe
4668	Unicorn-5085.exe
4552	Unicorn-25183.exe
1632	Unicorn-33601.exe
1580	Unicorn-33866.exe
388	Unicorn-33866.exe
940	Unicorn-14000.exe
3324	Unicorn-44577.exe
3584	Unicorn-23892.exe
4912	Unicorn-24157.exe
4852	Unicorn-4037.exe
3628	Unicorn-49709.exe
3136	Unicorn-35833.exe
1328	Unicorn-25618.exe
1712	Unicorn-3715.exe
4844	Unicorn-23581.exe
3372	Unicorn-3160.exe
2352	Unicorn-55683.exe
4028	Unicorn-44748.exe
3284	Unicorn-60529.exe
4952	Unicorn-24650.exe
3504	Unicorn-41732.exe
4608	Unicorn-55468.exe
2636	Unicorn-38137.exe
232	Unicorn-62833.exe
4488	Unicorn-50888.exe
1700	Unicorn-59818.exe
3388	Unicorn-52288.exe
1232	Unicorn-64561.exe
4344	Unicorn-93.exe
3236	Unicorn-93.exe
1692	Unicorn-53056.exe
4248	Unicorn-53056.exe
3076	Unicorn-40249.exe
452	Unicorn-36165.exe
4532	Unicorn-41318.exe
760	Unicorn-41318.exe
4708	Unicorn-8131.exe
4860	Unicorn-27997.exe
3524	Unicorn-27997.exe
2144	Unicorn-7877.exe
924	Unicorn-60093.exe
3820	Unicorn-60093.exe
1356	Unicorn-19807.exe
684	Unicorn-34611.exe
4880	Unicorn-32309.exe
4660	Unicorn-7108.exe
2676	Unicorn-32309.exe
1836	Unicorn-26443.exe
3708	Unicorn-12708.exe
224	Unicorn-29258.exe
5108	Unicorn-62013.exe
4392	Unicorn-9475.exe
1876	Unicorn-29341.exe
4292	Unicorn-10544.exe
4524	Unicorn-40823.exe

Program crash 16 IoCs

pid	pid_target	Process	procid_target
3856	2716	WerFault.exe	97
1828	2716	WerFault.exe	97
2336	3324	WerFault.exe	104
3140	3324	WerFault.exe	104
5480	2636	WerFault.exe	125
5140	1876	WerFault.exe	159
5264	2636	WerFault.exe	125
6776	224	WerFault.exe	156
8500	5312	WerFault.exe	196
8688	6396	WerFault.exe	245
9192	224	WerFault.exe	156
10748	5312	WerFault.exe	196
10292	6256	WerFault.exe	271
13932	6256	WerFault.exe	271
12856	8836	WerFault.exe	401
8424	8836	WerFault.exe	401

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44577.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32773.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48238.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15912.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4037.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33905.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6160	dwm.exe
Token: SeChangeNotifyPrivilege	6160	dwm.exe
Token: 33	6160	dwm.exe
Token: SeIncBasePriorityPrivilege	6160	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe
3204	Unicorn-4540.exe
1912	Unicorn-19289.exe
2936	Unicorn-56792.exe
2872	Unicorn-7249.exe
1184	Unicorn-23263.exe
60	Unicorn-36999.exe
3416	Unicorn-7249.exe
4928	Unicorn-45625.exe
2716	Unicorn-35411.exe
4668	Unicorn-5085.exe
4552	Unicorn-25183.exe
1632	Unicorn-33601.exe
940	Unicorn-14000.exe
1580	Unicorn-33866.exe
388	Unicorn-33866.exe
3324	Unicorn-44577.exe
3584	Unicorn-23892.exe
4912	Unicorn-24157.exe
3628	Unicorn-49709.exe
3136	Unicorn-35833.exe
4852	Unicorn-4037.exe
4844	Unicorn-23581.exe
4952	Unicorn-24650.exe
3504	Unicorn-41732.exe
3372	Unicorn-3160.exe
3284	Unicorn-60529.exe
1328	Unicorn-25618.exe
4608	Unicorn-55468.exe
1712	Unicorn-3715.exe
4028	Unicorn-44748.exe
2352	Unicorn-55683.exe
2636	Unicorn-38137.exe
232	Unicorn-62833.exe
4488	Unicorn-50888.exe
1700	Unicorn-59818.exe
3388	Unicorn-52288.exe
1232	Unicorn-64561.exe
4344	Unicorn-93.exe
3236	Unicorn-93.exe
1692	Unicorn-53056.exe
4248	Unicorn-53056.exe
3076	Unicorn-40249.exe
4708	Unicorn-8131.exe
3524	Unicorn-27997.exe
4860	Unicorn-27997.exe
452	Unicorn-36165.exe
3820	Unicorn-60093.exe
1356	Unicorn-19807.exe
924	Unicorn-60093.exe
760	Unicorn-41318.exe
4532	Unicorn-41318.exe
4880	Unicorn-32309.exe
684	Unicorn-34611.exe
3708	Unicorn-12708.exe
2144	Unicorn-7877.exe
1836	Unicorn-26443.exe
2676	Unicorn-32309.exe
4660	Unicorn-7108.exe
224	Unicorn-29258.exe
5108	Unicorn-62013.exe
4392	Unicorn-9475.exe
4440	Unicorn-36724.exe
1060	Unicorn-33617.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 3204	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	82
PID 3892 wrote to memory of 3204	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	82
PID 3892 wrote to memory of 3204	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	82
PID 3204 wrote to memory of 1912	3204	Unicorn-4540.exe	87
PID 3204 wrote to memory of 1912	3204	Unicorn-4540.exe	87
PID 3204 wrote to memory of 1912	3204	Unicorn-4540.exe	87
PID 3892 wrote to memory of 2936	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	88
PID 3892 wrote to memory of 2936	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	88
PID 3892 wrote to memory of 2936	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	88
PID 2936 wrote to memory of 2872	2936	Unicorn-56792.exe	90
PID 2936 wrote to memory of 2872	2936	Unicorn-56792.exe	90
PID 2936 wrote to memory of 2872	2936	Unicorn-56792.exe	90
PID 1912 wrote to memory of 3416	1912	Unicorn-19289.exe	91
PID 1912 wrote to memory of 3416	1912	Unicorn-19289.exe	91
PID 1912 wrote to memory of 3416	1912	Unicorn-19289.exe	91
PID 3892 wrote to memory of 60	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	92
PID 3892 wrote to memory of 60	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	92
PID 3892 wrote to memory of 60	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	92
PID 3204 wrote to memory of 1184	3204	Unicorn-4540.exe	93
PID 3204 wrote to memory of 1184	3204	Unicorn-4540.exe	93
PID 3204 wrote to memory of 1184	3204	Unicorn-4540.exe	93
PID 1184 wrote to memory of 4928	1184	Unicorn-23263.exe	96
PID 1184 wrote to memory of 4928	1184	Unicorn-23263.exe	96
PID 1184 wrote to memory of 4928	1184	Unicorn-23263.exe	96
PID 3204 wrote to memory of 2716	3204	Unicorn-4540.exe	97
PID 3204 wrote to memory of 2716	3204	Unicorn-4540.exe	97
PID 3204 wrote to memory of 2716	3204	Unicorn-4540.exe	97
PID 2872 wrote to memory of 4668	2872	Unicorn-7249.exe	98
PID 2872 wrote to memory of 4668	2872	Unicorn-7249.exe	98
PID 2872 wrote to memory of 4668	2872	Unicorn-7249.exe	98
PID 2936 wrote to memory of 4552	2936	Unicorn-56792.exe	99
PID 2936 wrote to memory of 4552	2936	Unicorn-56792.exe	99
PID 2936 wrote to memory of 4552	2936	Unicorn-56792.exe	99
PID 3892 wrote to memory of 1632	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	101
PID 3892 wrote to memory of 1632	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	101
PID 3892 wrote to memory of 1632	3892	ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe	101
PID 3416 wrote to memory of 1580	3416	Unicorn-7249.exe	102
PID 3416 wrote to memory of 1580	3416	Unicorn-7249.exe	102
PID 3416 wrote to memory of 1580	3416	Unicorn-7249.exe	102
PID 60 wrote to memory of 388	60	Unicorn-36999.exe	100
PID 60 wrote to memory of 388	60	Unicorn-36999.exe	100
PID 60 wrote to memory of 388	60	Unicorn-36999.exe	100
PID 1912 wrote to memory of 940	1912	Unicorn-19289.exe	103
PID 1912 wrote to memory of 940	1912	Unicorn-19289.exe	103
PID 1912 wrote to memory of 940	1912	Unicorn-19289.exe	103
PID 2716 wrote to memory of 3324	2716	Unicorn-35411.exe	104
PID 2716 wrote to memory of 3324	2716	Unicorn-35411.exe	104
PID 2716 wrote to memory of 3324	2716	Unicorn-35411.exe	104
PID 3204 wrote to memory of 3584	3204	Unicorn-4540.exe	105
PID 3204 wrote to memory of 3584	3204	Unicorn-4540.exe	105
PID 3204 wrote to memory of 3584	3204	Unicorn-4540.exe	105
PID 4928 wrote to memory of 4912	4928	Unicorn-45625.exe	106
PID 4928 wrote to memory of 4912	4928	Unicorn-45625.exe	106
PID 4928 wrote to memory of 4912	4928	Unicorn-45625.exe	106
PID 1184 wrote to memory of 3628	1184	Unicorn-23263.exe	108
PID 4552 wrote to memory of 4852	4552	Unicorn-25183.exe	107
PID 1184 wrote to memory of 3628	1184	Unicorn-23263.exe	108
PID 1184 wrote to memory of 3628	1184	Unicorn-23263.exe	108
PID 4552 wrote to memory of 4852	4552	Unicorn-25183.exe	107
PID 4552 wrote to memory of 4852	4552	Unicorn-25183.exe	107
PID 4668 wrote to memory of 3136	4668	Unicorn-5085.exe	109
PID 4668 wrote to memory of 3136	4668	Unicorn-5085.exe	109
PID 4668 wrote to memory of 3136	4668	Unicorn-5085.exe	109
PID 2936 wrote to memory of 1328	2936	Unicorn-56792.exe	110

C:\Users\Admin\AppData\Local\Temp\ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe
"C:\Users\Admin\AppData\Local\Temp\ad223d49b94fccb39e9bd5548c8e128ff76ee335a9abf2924da0ea8fb3c91c4eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24650.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11154.exe
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4922.exe
        9⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47573.exe
        10⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        10⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        10⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        9⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        9⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        8⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64965.exe
        8⤵
        
        PID:14796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        8⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18362.exe
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1803.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        9⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        9⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        9⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        9⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        8⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58880.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17484.exe
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        8⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50491.exe
        9⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17515.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59115.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        7⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52909.exe
        7⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25992.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        9⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        9⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        8⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9643.exe
        8⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        8⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9503.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15092.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        7⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18.exe
        7⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24191.exe
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2945.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44226.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38460.exe
        7⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39551.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9167.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26799.exe
        8⤵
        
        PID:17460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57994.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7756.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7994.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        9⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        10⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26991.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        9⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22314.exe
        9⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30299.exe
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15298.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25320.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        8⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48863.exe
        7⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5799.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        8⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10986.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25477.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8107.exe
        7⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9804.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23932.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3519.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8762.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5839.exe
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60017.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11518.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64979.exe
        7⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12250.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48019.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47957.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44019.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43282.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        6⤵
        
        PID:12872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33679.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        9⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
        9⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64351.exe
        9⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58851.exe
        9⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33032.exe
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49634.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        8⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        8⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15912.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
        9⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        9⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65075.exe
        9⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34657.exe
        8⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35565.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        7⤵
        
        PID:15456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59920.exe
        8⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30343.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26118.exe
        8⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50195.exe
        7⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39945.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
        7⤵
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48443.exe
        6⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19807.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        6⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44974.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        6⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        7⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49654.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8757.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        6⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34964.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56038.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55601.exe
        6⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13955.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        5⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        6⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55244.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45668.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19177.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26016.exe
        7⤵
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        7⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39339.exe
        6⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        6⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56354.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57351.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56738.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9790.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25669.exe
        6⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50536.exe
        7⤵
        
        PID:17524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        5⤵
        
        PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
      4⤵
      PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55559.exe
        6⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47153.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        5⤵
        
        PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47799.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24504.exe
      4⤵
      PID:15432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
      4⤵
      PID:17892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45625.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59818.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29341.exe
        7⤵
        Executes dropped EXE
        
        PID:1876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 720
        8⤵
        Program crash
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8166.exe
        9⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9119.exe
        9⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24661.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29308.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
        7⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10544.exe
        6⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        8⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54087.exe
        9⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        9⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56230.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28118.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53018.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41243.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37417.exe
        6⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11916.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35670.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27483.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
        6⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        7⤵
        
        PID:18104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54025.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42779.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26796.exe
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        9⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        9⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        8⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49908.exe
        8⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        7⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        8⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56525.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57692.exe
        7⤵
        
        PID:16896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51714.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36724.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42224.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52055.exe
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7863.exe
        8⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45623.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56909.exe
        7⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18387.exe
        7⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32598.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5949.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48931.exe
        7⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3769.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45514.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        6⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        9⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        9⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52011.exe
        7⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57289.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34160.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50903.exe
        7⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30889.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        6⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
        5⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6961.exe
      4⤵
      PID:2548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27227.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58114.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14686.exe
        7⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8669.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52187.exe
        6⤵
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29323.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        5⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33905.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50060.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-707.exe
        5⤵
        
        PID:17196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13577.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12983.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62520.exe
      4⤵
      PID:18428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29258.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6707.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35483.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62888.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        10⤵
        
        PID:15228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8836 -s 636
        10⤵
        Program crash
        
        PID:12856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8836 -s 636
        10⤵
        Program crash
        
        PID:8424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 656
        9⤵
        Program crash
        
        PID:10292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 656
        9⤵
        Program crash
        
        PID:13932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 720
        8⤵
        Program crash
        
        PID:8500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 768
        8⤵
        Program crash
        
        PID:10748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 724
        7⤵
        Program crash
        
        PID:6776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 724
        7⤵
        Program crash
        
        PID:9192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 716
        6⤵
        Program crash
        
        PID:5480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 716
        6⤵
        Program crash
        
        PID:5264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 724
        5⤵
        Program crash
        
        PID:2336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 724
        5⤵
        Program crash
        
        PID:3140
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 744
      4⤵
      Program crash
      PID:3856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 744
      4⤵
      Program crash
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42779.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35719.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46090.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
        7⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41870.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
        7⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59101.exe
        6⤵
        
        PID:14884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        6⤵
        
        PID:2900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44787.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60812.exe
        6⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27130.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        6⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35195.exe
        7⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24168.exe
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49921.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3903.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9475.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        6⤵
        
        PID:8672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        5⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21398.exe
        5⤵
        
        PID:17588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12528.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51568.exe
      4⤵
      PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50888.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
      4⤵
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        6⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64315.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        7⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        7⤵
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24330.exe
        6⤵
        
        PID:16616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40180.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40766.exe
        5⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
        5⤵
        
        PID:16744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64330.exe
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28524.exe
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
        6⤵
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20011.exe
        5⤵
        
        PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7942.exe
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
      4⤵
      PID:3868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40823.exe
    3⤵
    - Executes dropped EXE
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50371.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61008.exe
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62867.exe
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
      4⤵
      PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39935.exe
      4⤵
      PID:1668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56252.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60127.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        5⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        5⤵
        
        PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16467.exe
      4⤵
      PID:16600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
    3⤵
    PID:8464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
    3⤵
    PID:11560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15009.exe
    3⤵
    PID:16064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
    3⤵
    PID:6208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29810.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        9⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52379.exe
        9⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        8⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43963.exe
        9⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40639.exe
        9⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48103.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57159.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36333.exe
        8⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        8⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49198.exe
        6⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43547.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2291.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35394.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38403.exe
        8⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        7⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14557.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        7⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        8⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5845.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48792.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2301.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43937.exe
        6⤵
        
        PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53056.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28716.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32940.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        8⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30277.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49422.exe
        7⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13842.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64300.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55808.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        7⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
        7⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30032.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        6⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2440.exe
        5⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31111.exe
        8⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48564.exe
        7⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        6⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-491.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        7⤵
        
        PID:18212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3697.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22426.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8090.exe
        6⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        5⤵
        
        PID:9928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3401.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        5⤵
        
        PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9639.exe
        6⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41575.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43132.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        9⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65128.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        8⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27225.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60852.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        7⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        7⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        7⤵
        
        PID:15600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65284.exe
        7⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2085.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12306.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13474.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
        7⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18792.exe
        6⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41908.exe
        7⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        6⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-600.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39356.exe
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
      4⤵
      PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6163.exe
      4⤵
      PID:16492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
        6⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21741.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        7⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
        6⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39899.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24750.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16080.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
        6⤵
        
        PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49055.exe
        5⤵
        
        PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10215.exe
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47476.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26835.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13277.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
        5⤵
        
        PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        5⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42316.exe
        5⤵
        
        PID:17624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
      4⤵
      PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32287.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37497.exe
      4⤵
      PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36805.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32027.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31984.exe
        7⤵
        
        PID:16480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60423.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18578.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44309.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        5⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        5⤵
        
        PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        5⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-951.exe
        6⤵
        
        PID:16472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42713.exe
        5⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61692.exe
        5⤵
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61973.exe
      4⤵
      PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49913.exe
        5⤵
        
        PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4280.exe
      4⤵
      PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
      4⤵
      PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37351.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13282.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13203.exe
        7⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34708.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        6⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29426.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10224.exe
        6⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53983.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33505.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        5⤵
        
        PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
      4⤵
      PID:13956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27646.exe
      4⤵
      PID:16756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34616.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      4⤵
      PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13594.exe
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37167.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12498.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36270.exe
    3⤵
    PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41519.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
      4⤵
      PID:10732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49148.exe
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
    3⤵
    PID:16704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-93.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15971.exe
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19536.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23143.exe
        9⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54030.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55179.exe
        9⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3764.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56768.exe
        8⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6982.exe
        8⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10926.exe
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32498.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48015.exe
        6⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25556.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6270.exe
        7⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        6⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63784.exe
        7⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21118.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-978.exe
        6⤵
        
        PID:17708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8850.exe
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35757.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        7⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40972.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46592.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50266.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62395.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16069.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52374.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11.exe
        5⤵
        
        PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        5⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        7⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26732.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44480.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9857.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
        6⤵
        
        PID:16088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39891.exe
        6⤵
        
        PID:16868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44699.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12416.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53250.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4258.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        5⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60540.exe
        5⤵
        
        PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32097.exe
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24487.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11999.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11009.exe
        5⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5948.exe
        6⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30292.exe
        5⤵
        
        PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31710.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        5⤵
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2892.exe
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24390.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16229.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
      4⤵
      PID:6872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38804.exe
        5⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1658.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6178.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44043.exe
        7⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8482.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32929.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        5⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        6⤵
        
        PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28602.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19514.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37979.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4006.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22789.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3432.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41740.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21864.exe
      4⤵
      PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        5⤵
        
        PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        5⤵
        
        PID:18376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17933.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61080.exe
      4⤵
      PID:16928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      4⤵
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40003.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53713.exe
        5⤵
        
        PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54170.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
      4⤵
      PID:8344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43007.exe
    3⤵
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54018.exe
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58394.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28834.exe
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
      4⤵
      PID:18344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27377.exe
    3⤵
    PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22290.exe
    3⤵
    PID:10652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
    3⤵
    PID:14372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60506.exe
    3⤵
    PID:16456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
      4⤵
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64652.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2099.exe
        6⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3947.exe
        8⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65336.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39575.exe
        7⤵
        
        PID:16464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52058.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        6⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48238.exe
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60348.exe
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
      4⤵
      PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17641.exe
        5⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20803.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29923.exe
        6⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52343.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58238.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
      4⤵
      PID:12888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3900.exe
      4⤵
      PID:560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1096.exe
    3⤵
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65420.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46628.exe
        5⤵
        
        PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45810.exe
      4⤵
      PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35850.exe
      4⤵
      PID:632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56131.exe
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34148.exe
      4⤵
      PID:17576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23013.exe
    3⤵
    PID:9124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61455.exe
    3⤵
    PID:12644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
    3⤵
    PID:10112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60093.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
      4⤵
      PID:644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45680.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61684.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10345.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56478.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40396.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41342.exe
      4⤵
      PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23562.exe
      4⤵
      PID:16736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35554.exe
    3⤵
    PID:6396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6396 -s 632
      4⤵
      Program crash
      PID:8688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64626.exe
    3⤵
    PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
    3⤵
    PID:12548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5091.exe
    3⤵
    PID:5172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5555.exe
    3⤵
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45659.exe
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61196.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34900.exe
        5⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24636.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exe
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
      4⤵
      PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36530.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61243.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1067.exe
        5⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        5⤵
        
        PID:18096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
      4⤵
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45165.exe
    3⤵
    PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54301.exe
    3⤵
    PID:12648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19315.exe
    3⤵
    PID:3592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
  2⤵
  PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
    3⤵
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41626.exe
    3⤵
    PID:10968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
    3⤵
    PID:15332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51493.exe
  2⤵
  PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18696.exe
    3⤵
    PID:12320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-411.exe
    3⤵
    PID:2824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12490.exe
  2⤵
  PID:10472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
  2⤵
  PID:15176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33748.exe
  2⤵
  PID:18248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2716 -ip 2716
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2716 -ip 2716
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3324 -ip 3324
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3324 -ip 3324
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2636 -ip 2636
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1876 -ip 1876
1⤵
PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2636 -ip 2636
1⤵
PID:7024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 224 -ip 224
1⤵
PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6396 -ip 6396
1⤵
PID:8972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5312 -ip 5312
1⤵
PID:7480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 224 -ip 224
1⤵
PID:8132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5312 -ip 5312
1⤵
PID:10604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6256 -ip 6256
1⤵
PID:9560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6256 -ip 6256
1⤵
PID:13408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8836 -ip 8836
1⤵
PID:13900

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 8836 -ip 8836
1⤵
PID:8880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe

Filesize
468KB

MD5
2dbd6dee975d1c6a2aded4099095e472

SHA1
dc4a24efd7428103d7414f20206c0f651ec734b9

SHA256
2c9955f76b487246cff1031390db0f00765d2bf6823ed13954dd4ac9800e4693

SHA512
65205a2cf7e27c12062b724ef8bb5af9496f333d27dd241e3296c68847c32d7d7058a03e4c9622bb303d4cf3dc9e48afaa31087f35c0dfab9e7a02945f08e484

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14000.exe

Filesize
468KB

MD5
2bf8a1ced6b681bd5961cb769dec4753

SHA1
57c6fb80d84c12a3f855fed3585e21b0f787af7d

SHA256
e15fbbe2a8137aa3af96a43e36ef3b14b2694f758442e1c62a9874ec79052cf9

SHA512
78083937ce8719559fdb12c47a09123eda37f1243a561dd1d443358e46928cb142fe57c82b41a2480bd9d68155f88982ce17440eb1c4aa2b7101bb9ff0a808ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe

Filesize
468KB

MD5
81b222792382b10e68a64c226ca604e6

SHA1
2c59b099f83a2f6a9e08ee88ec4ff8e2e474a532

SHA256
12ab1bf783bc46ee8253df3262d0a186eae19cdec1c7dde914af777f322535b5

SHA512
7d0f4edb44b9cac6b02e8ba390993bd1458e59b1eb97592e2020e73e1bed8ec514b6f37a0aca9a6b04d84f7111c5d41e6e5f8e0dd48ece57811165ee733d0071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe

Filesize
468KB

MD5
ce4c46446d324e1238c9611184aa098a

SHA1
b206a8c4d8debb4e71c2cfa3f172fa4b17b46194

SHA256
5b6fa2c03c6d82e5954ae2375f050bb325609381d90d1ecfd0980e4ab7bf07e3

SHA512
f5c684be6bcdee67d02bd66b4f95acbdca4ab956910400e3d8d1fbeefa3cd40349527cf94e793f5b4e662e27689f95f3ffa764a78484e94770552ac37712e3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23581.exe

Filesize
468KB

MD5
8488901abd009b55c816a0b1e9b78541

SHA1
8775060fbc5a7487c1848578d781d30426630eba

SHA256
b83c1643259fe1d64512bae914fac76103918241f17ea2261d4fd951720dd5b6

SHA512
ecac04a0e6b44833feb80963084a2995ebe7de7a1bad7c1570cf5c9951a0d3cb020636e866e81a387174e039df0e49261775ff83f31fa91d632ee7fa5b8c53e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe

Filesize
468KB

MD5
dec38e713b66a5c6dacd372aeb871e8e

SHA1
86faac27fe84a07cc4bc8b5b4fbaee1005631880

SHA256
14bbe9c8d96a7467991716069b75a4bad490f19e0956c2e498b1884482bd6716

SHA512
c0238068e03b59c5b5a84fae4882a67567b56cec204388023ea9b9ca139062cf1b4a85b3b4b5e837d36bed208ab83ddc86db367a39edacb333876c75f4bf4d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe

Filesize
468KB

MD5
a04984e3177438ed1dc44715debb560d

SHA1
91b1a46f91142a64858cba12f26d7f9c0c77fcae

SHA256
f654b41d41b683266a182685ecf4b9b424a9409a8dd3f69eb8731d449ae4336c

SHA512
8f38f4f3e70d6c0a028442458f980d089c1a839266e6f8134be5187f9406fefc77d7016e3f3470bb16fd8793bac7da2e952fdb220610398a1320b218b3e62e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24650.exe

Filesize
468KB

MD5
80541e91d5e5db7fbb825131038e44fc

SHA1
ea33a4715e0b15e5bec87b449efe2bb169f291eb

SHA256
b68ea38e887df0c79951fd5ad355714d90a92fa933b35637b55bfd61ea8cdc5e

SHA512
a0ae6bc0734b81ce28648c26fb74d6989cbca3359d0e0ed067d70268d14f798ff8765213f312fa50388332597e94a78a1280ea4f95ca4c4ac8698101f2bbfa63

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe

Filesize
468KB

MD5
c0cf8f2e7a8cf3eac91d9498efaf3797

SHA1
47a76d542757d56b6dee490c6b92da46631d56ba

SHA256
358db88587ee81ca78ad956edd28a3b9d1dfe40fe37c047c6b2bf3849323fa70

SHA512
b80f7a410951aa330700606c9291f8573924a818ff4e2f58b3998e51669c34bef7770c80d2e3cbd3c406ef301764ce4295f3e08a459dd3694cd630f14c6fb9a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe

Filesize
468KB

MD5
2fecf3cf68d2772d1cb73114ceca303d

SHA1
83b877f7054db89ee4df4fde0709a3a97488fc7f

SHA256
87efa68f1169c31537bbe507c873c70d1f8836c8e0240744e618a1db4a96ec97

SHA512
1ecd959aeb7c641d108810535f18a90812af5d32a5b221677ab76ac50900851cca7d43b594b136e110c8581293c4513f116c37c19d0283c9379203a23b857f0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe

Filesize
468KB

MD5
bb9f45afcaeee573ebd04c5cc92d10f1

SHA1
c3cdebb62cc7f9c8e67432c19f54265957519c67

SHA256
865ab6b2b994a6e6ae2f578412122d097660ecff16699703ea659f932c32f771

SHA512
026910404aa7230b5da7ca170f8d0356513029f1e425756fede00e009fe17e58c8fcfb3e4bb6964d459dd42226dee86fb115bc637a0b75848be51af97698baf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe

Filesize
468KB

MD5
a05fa7429eac9bce9e08df691957906d

SHA1
52d5316764db31f145160d46f9e1fa3975c4ad2d

SHA256
5f7319fd02e2a3871a81ca1339acf0801cc77a2ff3ec51a2eecaf339c4dbc0b5

SHA512
9ad945ce5a2632baff806cc91b5e6cf41913ba665b856648ca064b673d7e84ab22a29eecec6e67812f05c8920f12ec362336ca4f7f19480359b570239d4dc16a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe

Filesize
468KB

MD5
c32fde2c7b50d380ebb8d08e4e04a5e9

SHA1
389481d5cfb592471f8b55ce1a1ed72f4e7c8594

SHA256
cb8f196a2a0067bf8ea99ced104058cd1fe5de4c4ee0ff044ef572db2dde7a6a

SHA512
c2426b7b48ce99f229a5f1c88dd958ff432953948c432d6e055d0ad17493d8e3b032df17f78bf8f7718a36e5141f7cd02567b52b057e611d0fe2a16526b6621d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35411.exe

Filesize
468KB

MD5
83e72446817ffa5b86c94094100db8bc

SHA1
6d4a78bb6c0648968e713d35fe5b872d11f065b7

SHA256
afd3e5bd540e906b0113d056328fa2a6dc29fe7f75967f7d59745931e52721c7

SHA512
4eaba6d067ad260e2983cdfcc30611b190c681e7acab369e7c788a45fc159d39d125a61762f9d1c493054523253f9f9f7e180e05910a2c4400da6f1ddb70a9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe

Filesize
468KB

MD5
3316ae9b7d3725a416c603df16e0d923

SHA1
0f10fa6b635a5825420b096ff7cd5d0b88c06e39

SHA256
9bc405dc7d4aa990a1d483445f3d37d9cd0b6aee1a85da208f78d284fbecb38f

SHA512
7a39e19d029100d500353fe6b66379ddd7d92cbf92f353ba1f5a6f65b035857b4b8aca784106978163525d3a71332aed63d8e75bee1112974b1ed6ae5ea7f132

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe

Filesize
468KB

MD5
e34c7595051e9636f338c687ae38c013

SHA1
0ecbdaa0e29d73e7b8fded0231575696be2dae08

SHA256
0e14480806b3d16e7247fd5b3c77492cb729e2b63b60f79b7d137da1d48e6f3e

SHA512
2bd565ea8a017019ebf87136e42b3d3b094b98935ab18622a76e0c6d9088f61af8db959fc8f58c08505a0994ca4c4461bfb10576c144ecd0763ac470bd5fb804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3715.exe

Filesize
468KB

MD5
1b0c930358a0b29a990ff33445a09cce

SHA1
90a227199e8f7edde144593165a7f7f9dffee1cf

SHA256
c31643e1b1e075b0b1de00347ecf7eb33d4e2f732613fcdd37f49622cef9dae0

SHA512
f504ec7865b6067c6f3fe461de8663f9c93960a5fcb7262d73f81350bb0923e6d1e550866e1de53515dd1530243645e947ae6ce6964895f9f22a1fb310428c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38137.exe

Filesize
468KB

MD5
a3eb2a9a9774f829de5c3f52f8deae8a

SHA1
56550df63fc9de4e2d7479e9be8afb452dced6d3

SHA256
e854b3dfb730f6cf4242e24d7cf9c88033f914b5fdd1797f66e5ef0c19379553

SHA512
7f84c628bd8f25741199b2fbe2d71ffb54a3a0a98a9e0eb4b8e8365c0c57ae3183d4b29a1b36ba08f120e1734fd3a705f6e72d34d5b9bebd0ca1f26bdca6d79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4037.exe

Filesize
468KB

MD5
1dabba33e7897be671240d763dfca9db

SHA1
3c5dc3e37ce3a418a92870beb1adad51ebe7339f

SHA256
c52f5306fdb83f534fcb991919532083858f1523781f54b1419a0f705543f07b

SHA512
08069143b447e1b247c08ac433813d47e6daf62eaf6b7833b4ab8d4abdd85c1a19500b716a096112afa4653f67653e1fcc695f4d046b527863847548dd0b2d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe

Filesize
468KB

MD5
603eeb9f0b2bdd149a719ffa7144abb5

SHA1
bf6375f07da1847e13938c31964106cf443efe11

SHA256
9c8f95e35f29bc810f3298d6157b07977259613c1a0da67c85a177aa7cd203e3

SHA512
0ccf707d97c663aa11b710c1337983a11d99b205d4aa4e160dc294cd3e6fc556c1e023311a411a0300c749ef20d201ca1f07c5c16b8bcff0460f09842b23389e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe

Filesize
468KB

MD5
704eda189439563f471722a2386ae9cf

SHA1
7e109ec20c5135280e79b9e0075e413aa77135d8

SHA256
33712870294bb9213adc9f4ccd7d867c3baabc1536ce6909bafed91ad5a309e8

SHA512
391e9a415d65a5fe2fe4b8c3698828e6963788fd3cf5e06e807e00be7d7964a9def8aaf971da9831fa9577fa56eb135515fc133e49811217c8a58c531cbfa333

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44748.exe

Filesize
468KB

MD5
fcd59ba580b028a8b360c5ee24fed76f

SHA1
17d4d6e1759aafbec773dde982a55811dfb55112

SHA256
b82ace171edd8b0dc12432fc7d980770127dec3975726c37ba1fb65a556b80c8

SHA512
600fc60eb4697302611d1328fbda6e97b81d425d1da56268368fa7a1c81af7b5f87619c8cef7961e3b907ce56de00dc6e7de151162729fda3efcf054bdccf513

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4540.exe

Filesize
468KB

MD5
bffdba78f464a6f67abf492d66082d4a

SHA1
203730dec7e6621fbb1607c7ddf0bea80730e899

SHA256
e212d858d71e6bfecc2a06b54ae3ab0f665582ae621d9e4741a8a3fea5773b58

SHA512
6ba299e816db5d4f2df4780c94b10d5fcc887b8080d3121c3af7eb87566c27bc51d9895403c61216783e4fddd64417926d2d0764f95f7c61885d1cd5f954ad1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45625.exe

Filesize
468KB

MD5
c15c15d14b29fba6fc0d227ba938c428

SHA1
c5a0d4c36fe60d27c77da8f010a3a80a2e8f0351

SHA256
538747bff3885b090cf61a02f7a82f44b6609f6f46f9f24bc6798459e8f64f23

SHA512
f79e60b85af623d0f4f5a7fb1cba937eacf1d9699d90de6e340f25a30cc42eea511fe2126f6caf39bd4103341ef74893b57efc7c2b873ec6741bc3a819a99504

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe

Filesize
468KB

MD5
3d967e402434518c0d35f30cde0fec96

SHA1
52eb2df6956bec4c064b198632a6bec23c7a2041

SHA256
abdcd377a7b5461c941bbf37b418100f7a3a19d4c26c2d4de6b6e98661ce2904

SHA512
5e2257cc3039b398d53c9525abf049f1e10daaece609586eb3237bab110b7ec6b242e35532cdbb974c528ec35491a74e4ddb00e6d0823efae6e31f9217a48d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5085.exe

Filesize
468KB

MD5
0407072a6c92ce932e20ff88233146f4

SHA1
5151ac434b61a89ce64595cc23f4fb262a9e2720

SHA256
cbfcaa4fb7a54628e76d08a5478c4e9718a640d1f35bff623110467937b61e8d

SHA512
4931965898952c53b7b9ac84ad99cfc4572a73a72ecbac13669befcd6a8e27d4d2ec067cea6dd7093819aa80a9ab1e7741d4fd31b3f1bd2b09e6b5a6d2ff6d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe

Filesize
468KB

MD5
1ff26ee27cc8d5049eef445d8432e97c

SHA1
f1785767c75a99f29d6016bd72bcad7d1e4c8d2b

SHA256
e570a32a95dea8e0d50481f7a227f1515b8b5eb7c128a9ccec4e4c1462f2a0cb

SHA512
0c0800e0a0feb4e39fd02dc9f9ea0e6fb538d5123fac4ef622149b605bc1ffe118bf2709e96abf9c04e9cc0f239768ffb72dccc6248124af0a8cee80d9a1c357

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55683.exe

Filesize
468KB

MD5
0bf3b22735d8843ac3b2d1e55ac6ec16

SHA1
2f4149e31048f515327a12428d2cd38ffdbeedf1

SHA256
02240b5c16e0a76848a3fcf1cfc0d87df18fcae5df88ee47ad454f91a40477a9

SHA512
eeae2b95296f4958e881c4b204b8540022a774e3cb03870cd8e001bfb17b7dcdb4dda4b905f0382a78d1d0c64f7587b55bccfffd727eadbda6901a08d4160da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56792.exe

Filesize
468KB

MD5
9920cbd4834cf80fe5158e910210e0a9

SHA1
ab3fdbaf37cbdfd5a4a7ab081212a7539ec96fc2

SHA256
9e0df3ded35a951cbfe16a1208cf1e2cd92ff4f1b35880afbfedf41e2876b34c

SHA512
927d10b30f044148b3ad093f40e8975a5c23a4bbb250c25eb30dd97c775368e8344d15c9c160482c8dfadf8ee78f99b280b0a4a9da91727acf82482cb1271354

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60529.exe

Filesize
468KB

MD5
aaf75d6843648e80d11ea11ef5065340

SHA1
a9374309e63328040d615ea4761f9c960dfc1a27

SHA256
9e535c375d7eec0e991f3e371f0dae1dde89415f78951df59aeeb116fe26aee3

SHA512
6908d1002b6f5c3324b6fa6eb192a94f4039824c981826f78f73cd644af2344a4ea69543ecb6218ff7b3a5bf893cf14bf9961339d32d57f49c230e79414e16e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe

Filesize
468KB

MD5
0732a58a08b2322129073677bdfb7427

SHA1
f610a9a5de6eb921c2caf3898cb0725674ccc110

SHA256
e773da9b94f28b223d8d8f883508911a8421ddaec03e6309d3ea441180db948a

SHA512
c8ad322294ab2700da41b8dbeddc60b813d70110c6c60d42cced18a4ace9042af0c6a887106d7cd43a094cee8f3d7be24f77f24526098f52c3fbbbc13475e4e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62833.exe

Filesize
468KB

MD5
f3dba9185f552fb413ca74528ba4ad45

SHA1
f19a5168ef9f31fb3af25c0c79101eb556f2adb4

SHA256
2227eb894a5e5bfc3da07bf14fe7fc5b55ed51cbad65912bbc76f528d7a9635d

SHA512
2a1bff1d7e0d380da5b50adb6df669885448f18e599b96c1aa42037943d5493316412aa915fbb5ac12752dd1ac5619148cb0f09ed47ec190fba900a293614c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7249.exe

Filesize
468KB

MD5
278a3c76b788d3e1bcf7956fc696a3e6

SHA1
27f1f4f0d9cf8098136f35867bb99ee48f3f092b

SHA256
b9a6a61a52e33f1577165d66505388d1e2176800625633c65453e15221b0a99d

SHA512
2f0e8127273151cf96865c1aaaa49a1ed3fadc264ac26c7e7029ca33adeda87e10da7e58a8aeaa0df099799da17a5c104537cd946a22910ca77e6bec84d73d62

Download Submit
memory/60-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/228-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/452-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/924-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/940-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2220-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2720-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3324-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4152-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4392-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5108-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14884-2527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads