224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8d

Analysis

max time kernel
118s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe
Size

468KB
MD5

5bc82f86e33a1686aa4facdec02403f0
SHA1

526f956abdce0fd83583350d14bb836bc14f2265
SHA256

224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8d
SHA512

a18205e54a04ec471749b17156a1348fce4bfa7c177cca258c58ddede8ffef7da2ace79f1b60e55fc4b7680aa3bd327ff7a7a862f8b9baab203cf9c5382bf2c7
SSDEEP

3072:jGFHoDIKI05TtbY2HzcOcf8/zChpP0ptnLHeTVPagq3AVC2ghsld:jGlo+8TtxH4OcfxYgYgqQc2gh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1044	Unicorn-56822.exe
4556	Unicorn-53973.exe
2636	Unicorn-8301.exe
2604	Unicorn-13293.exe
4932	Unicorn-23691.exe
1824	Unicorn-29822.exe
1480	Unicorn-18124.exe
1628	Unicorn-24446.exe
4784	Unicorn-35908.exe
4760	Unicorn-31270.exe
3744	Unicorn-31270.exe
652	Unicorn-41668.exe
3992	Unicorn-27932.exe
2464	Unicorn-64134.exe
620	Unicorn-6500.exe
1984	Unicorn-34062.exe
748	Unicorn-22748.exe
2400	Unicorn-57798.exe
1140	Unicorn-10827.exe
1296	Unicorn-621.exe
696	Unicorn-13620.exe
744	Unicorn-41846.exe
4532	Unicorn-33486.exe
4008	Unicorn-33486.exe
4880	Unicorn-40777.exe
3244	Unicorn-40777.exe
32	Unicorn-5644.exe
3880	Unicorn-16579.exe
4216	Unicorn-25245.exe
4796	Unicorn-35908.exe
3976	Unicorn-59342.exe
1844	Unicorn-56005.exe
3556	Unicorn-26862.exe
4912	Unicorn-45428.exe
1100	Unicorn-44468.exe
2404	Unicorn-34454.exe
1928	Unicorn-3893.exe
4048	Unicorn-7188.exe
1960	Unicorn-26981.exe
3740	Unicorn-41958.exe
5032	Unicorn-11323.exe
1016	Unicorn-42150.exe
840	Unicorn-1309.exe
3120	Unicorn-56572.exe
944	Unicorn-45637.exe
2732	Unicorn-56265.exe
5020	Unicorn-65502.exe
1872	Unicorn-40998.exe
1672	Unicorn-56565.exe
4384	Unicorn-33022.exe
1408	Unicorn-57526.exe
2836	Unicorn-49358.exe
4428	Unicorn-29492.exe
3172	Unicorn-2387.exe
4896	Unicorn-62357.exe
2616	Unicorn-62357.exe
1916	Unicorn-32949.exe
3248	Unicorn-21516.exe
3280	Unicorn-21516.exe
1500	Unicorn-9861.exe
2008	Unicorn-18030.exe
2128	Unicorn-10053.exe
1168	Unicorn-10053.exe
1148	Unicorn-12091.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
10000	7040	WerFault.exe	270
11612	7032	WerFault.exe	269
12108	7040	WerFault.exe	270
13204	7032	WerFault.exe	269
17140	16040	WerFault.exe	758
4420	16380	WerFault.exe	769

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39369.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51189.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25791.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21067.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25091.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6712	dwm.exe
Token: SeChangeNotifyPrivilege	6712	dwm.exe
Token: 33	6712	dwm.exe
Token: SeIncBasePriorityPrivilege	6712	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe
1044	Unicorn-56822.exe
4556	Unicorn-53973.exe
2636	Unicorn-8301.exe
1824	Unicorn-29822.exe
4932	Unicorn-23691.exe
2604	Unicorn-13293.exe
1480	Unicorn-18124.exe
1628	Unicorn-24446.exe
4784	Unicorn-35908.exe
3992	Unicorn-27932.exe
620	Unicorn-6500.exe
3744	Unicorn-31270.exe
4760	Unicorn-31270.exe
652	Unicorn-41668.exe
2464	Unicorn-64134.exe
1984	Unicorn-34062.exe
748	Unicorn-22748.exe
2400	Unicorn-57798.exe
1140	Unicorn-10827.exe
696	Unicorn-13620.exe
1296	Unicorn-621.exe
4532	Unicorn-33486.exe
744	Unicorn-41846.exe
4796	Unicorn-35908.exe
32	Unicorn-5644.exe
4008	Unicorn-33486.exe
3880	Unicorn-16579.exe
4880	Unicorn-40777.exe
3244	Unicorn-40777.exe
4216	Unicorn-25245.exe
3976	Unicorn-59342.exe
1844	Unicorn-56005.exe
3556	Unicorn-26862.exe
4912	Unicorn-45428.exe
1100	Unicorn-44468.exe
2404	Unicorn-34454.exe
1928	Unicorn-3893.exe
4048	Unicorn-7188.exe
1960	Unicorn-26981.exe
3740	Unicorn-41958.exe
5032	Unicorn-11323.exe
1016	Unicorn-42150.exe
840	Unicorn-1309.exe
944	Unicorn-45637.exe
2732	Unicorn-56265.exe
3120	Unicorn-56572.exe
1872	Unicorn-40998.exe
5020	Unicorn-65502.exe
2836	Unicorn-49358.exe
1916	Unicorn-32949.exe
4896	Unicorn-62357.exe
2616	Unicorn-62357.exe
3172	Unicorn-2387.exe
4428	Unicorn-29492.exe
1408	Unicorn-57526.exe
1672	Unicorn-56565.exe
3280	Unicorn-21516.exe
4384	Unicorn-33022.exe
3248	Unicorn-21516.exe
1500	Unicorn-9861.exe
1168	Unicorn-10053.exe
2008	Unicorn-18030.exe
1460	Unicorn-50821.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1044	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	82
PID 2524 wrote to memory of 1044	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	82
PID 2524 wrote to memory of 1044	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	82
PID 2524 wrote to memory of 4556	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	83
PID 2524 wrote to memory of 4556	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	83
PID 2524 wrote to memory of 4556	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	83
PID 1044 wrote to memory of 2636	1044	Unicorn-56822.exe	84
PID 1044 wrote to memory of 2636	1044	Unicorn-56822.exe	84
PID 1044 wrote to memory of 2636	1044	Unicorn-56822.exe	84
PID 4556 wrote to memory of 2604	4556	Unicorn-53973.exe	87
PID 4556 wrote to memory of 2604	4556	Unicorn-53973.exe	87
PID 4556 wrote to memory of 2604	4556	Unicorn-53973.exe	87
PID 2636 wrote to memory of 1824	2636	Unicorn-8301.exe	88
PID 2636 wrote to memory of 1824	2636	Unicorn-8301.exe	88
PID 2636 wrote to memory of 1824	2636	Unicorn-8301.exe	88
PID 2524 wrote to memory of 4932	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	89
PID 2524 wrote to memory of 4932	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	89
PID 2524 wrote to memory of 4932	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	89
PID 1044 wrote to memory of 1480	1044	Unicorn-56822.exe	90
PID 1044 wrote to memory of 1480	1044	Unicorn-56822.exe	90
PID 1044 wrote to memory of 1480	1044	Unicorn-56822.exe	90
PID 1824 wrote to memory of 1628	1824	Unicorn-29822.exe	93
PID 1824 wrote to memory of 1628	1824	Unicorn-29822.exe	93
PID 1824 wrote to memory of 1628	1824	Unicorn-29822.exe	93
PID 2636 wrote to memory of 4784	2636	Unicorn-8301.exe	94
PID 2636 wrote to memory of 4784	2636	Unicorn-8301.exe	94
PID 2636 wrote to memory of 4784	2636	Unicorn-8301.exe	94
PID 1480 wrote to memory of 3744	1480	Unicorn-18124.exe	96
PID 1480 wrote to memory of 3744	1480	Unicorn-18124.exe	96
PID 1480 wrote to memory of 3744	1480	Unicorn-18124.exe	96
PID 2604 wrote to memory of 4760	2604	Unicorn-13293.exe	97
PID 2604 wrote to memory of 4760	2604	Unicorn-13293.exe	97
PID 2604 wrote to memory of 4760	2604	Unicorn-13293.exe	97
PID 1044 wrote to memory of 652	1044	Unicorn-56822.exe	99
PID 1044 wrote to memory of 652	1044	Unicorn-56822.exe	99
PID 1044 wrote to memory of 652	1044	Unicorn-56822.exe	99
PID 4556 wrote to memory of 3992	4556	Unicorn-53973.exe	98
PID 4556 wrote to memory of 3992	4556	Unicorn-53973.exe	98
PID 4556 wrote to memory of 3992	4556	Unicorn-53973.exe	98
PID 4932 wrote to memory of 2464	4932	Unicorn-23691.exe	100
PID 4932 wrote to memory of 2464	4932	Unicorn-23691.exe	100
PID 4932 wrote to memory of 2464	4932	Unicorn-23691.exe	100
PID 2524 wrote to memory of 620	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	101
PID 2524 wrote to memory of 620	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	101
PID 2524 wrote to memory of 620	2524	224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe	101
PID 1628 wrote to memory of 1984	1628	Unicorn-24446.exe	104
PID 1628 wrote to memory of 1984	1628	Unicorn-24446.exe	104
PID 1628 wrote to memory of 1984	1628	Unicorn-24446.exe	104
PID 1824 wrote to memory of 748	1824	Unicorn-29822.exe	105
PID 1824 wrote to memory of 748	1824	Unicorn-29822.exe	105
PID 1824 wrote to memory of 748	1824	Unicorn-29822.exe	105
PID 4784 wrote to memory of 2400	4784	Unicorn-35908.exe	106
PID 4784 wrote to memory of 2400	4784	Unicorn-35908.exe	106
PID 4784 wrote to memory of 2400	4784	Unicorn-35908.exe	106
PID 2636 wrote to memory of 1140	2636	Unicorn-8301.exe	107
PID 2636 wrote to memory of 1140	2636	Unicorn-8301.exe	107
PID 2636 wrote to memory of 1140	2636	Unicorn-8301.exe	107
PID 4760 wrote to memory of 1296	4760	Unicorn-31270.exe	108
PID 4760 wrote to memory of 1296	4760	Unicorn-31270.exe	108
PID 4760 wrote to memory of 1296	4760	Unicorn-31270.exe	108
PID 2604 wrote to memory of 696	2604	Unicorn-13293.exe	109
PID 2604 wrote to memory of 696	2604	Unicorn-13293.exe	109
PID 2604 wrote to memory of 696	2604	Unicorn-13293.exe	109
PID 3992 wrote to memory of 4008	3992	Unicorn-27932.exe	110

C:\Users\Admin\AppData\Local\Temp\224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe
"C:\Users\Admin\AppData\Local\Temp\224bdedb2f5596603fc4dcddb8d36fa702d8418b1af0deb6048b9eca6ef7bf8dN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        9⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38025.exe
        10⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        11⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25532.exe
        11⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        11⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        10⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        10⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        10⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16870.exe
        10⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
        10⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
        9⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        10⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        10⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        9⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        9⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8844.exe
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        9⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        10⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        10⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        10⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        9⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        9⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        9⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28547.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54124.exe
        9⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        8⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        8⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63893.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6523.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        9⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        9⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        9⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        8⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        8⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        8⤵
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31045.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25566.exe
        7⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63535.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18030.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40230.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17854.exe
        9⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        10⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31572.exe
        10⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        10⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        10⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26543.exe
        9⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        9⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7683.exe
        9⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        8⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11235.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27390.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        8⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6757.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32597.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19046.exe
        7⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
        7⤵
        
        PID:17036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
        7⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12091.exe
        6⤵
        Executes dropped EXE
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36494.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54613.exe
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        8⤵
        
        PID:13976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55653.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32398.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28445.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        7⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57394.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13053.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22748.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        9⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40182.exe
        10⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39372.exe
        10⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34044.exe
        9⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        10⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        10⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        9⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20235.exe
        9⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2264.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        9⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18755.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55952.exe
        8⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17552.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60629.exe
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58606.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        9⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        9⤵
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5988.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49828.exe
        8⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-206.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32030.exe
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25973.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47028.exe
        7⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        7⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
        6⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        8⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        9⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        9⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        8⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45958.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        8⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42500.exe
        7⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        7⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56405.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52956.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47580.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51606.exe
        6⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45428.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
        6⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        9⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11604.exe
        9⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2379.exe
        9⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        8⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        8⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21060.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
        7⤵
        
        PID:12244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12217.exe
        7⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2875.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49902.exe
        7⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65356.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49604.exe
        6⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50821.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50981.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50940.exe
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22939.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26171.exe
        6⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6125.exe
        5⤵
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20089.exe
        5⤵
        
        PID:15916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3997.exe
        7⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40137.exe
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
        10⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24572.exe
        10⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        10⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54827.exe
        9⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        9⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39756.exe
        9⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        9⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53356.exe
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
        8⤵
        
        PID:16068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5757.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23487.exe
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32299.exe
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        7⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25604.exe
        7⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16996.exe
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        8⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47598.exe
        9⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        9⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        8⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26269.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        7⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        7⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17187.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22230.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44941.exe
        7⤵
        
        PID:16928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48921.exe
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        6⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63982.exe
        8⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        9⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        9⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3723.exe
        9⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        8⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        8⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13167.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33581.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        7⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        7⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14763.exe
        7⤵
        
        PID:16552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5516.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59118.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57503.exe
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62973.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33317.exe
        7⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42782.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        7⤵
        
        PID:16988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44864.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48484.exe
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44181.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
        6⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54004.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54597.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51189.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3893.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53582.exe
        6⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        8⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        8⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26845.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        7⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63230.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        7⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        6⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39471.exe
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8495.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47052.exe
        7⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43068.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16563.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32667.exe
        5⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26883.exe
        6⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25728.exe
        6⤵
        
        PID:3500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-771.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30196.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        5⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        5⤵
        
        PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        5⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2724.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        7⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58926.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
        7⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        6⤵
        
        PID:16096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        6⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54486.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53181.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53876.exe
        6⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56263.exe
        6⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        5⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
        5⤵
        
        PID:16828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43692.exe
      4⤵
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48398.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9109.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5693.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        7⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22522.exe
        7⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35989.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        6⤵
        
        PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
        5⤵
        
        PID:13884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3244.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8867.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32704.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54534.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
      4⤵
      PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
      4⤵
      PID:15876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49358.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54070.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9725.exe
        9⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45271.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        8⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41076.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46795.exe
        7⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12045.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11966.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21748.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20187.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40384.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        6⤵
        
        PID:14400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26597.exe
        6⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        7⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        7⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        7⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12315.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26373.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4075.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        6⤵
        
        PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38999.exe
        5⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14029.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        5⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31688.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:32
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3525.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56670.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        8⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7548.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51381.exe
        7⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40649.exe
        7⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        7⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16459.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24651.exe
        6⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24111.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62028.exe
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17948.exe
        6⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        6⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54333.exe
        5⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23794.exe
        5⤵
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45518.exe
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23718.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
        7⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
        7⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49445.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18278.exe
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20172.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47625.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        6⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-699.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25035.exe
        5⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9679.exe
        5⤵
        
        PID:13780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7195.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9325.exe
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-843.exe
        5⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25462.exe
      4⤵
      PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42150.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37630.exe
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45129.exe
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17908.exe
        8⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        8⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32749.exe
        8⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7798.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21188.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        7⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2995.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50581.exe
        7⤵
        
        PID:15904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        7⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40188.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        6⤵
        
        PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        7⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58549.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        6⤵
        
        PID:17312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37380.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43294.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13206.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        5⤵
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37541.exe
        5⤵
        
        PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36878.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42127.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16268.exe
        7⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
        7⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33454.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32596.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39812.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62517.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
        6⤵
        
        PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
        5⤵
        
        PID:7032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 632
        6⤵
        Program crash
        
        PID:11612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 632
        6⤵
        Program crash
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26731.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27712.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22155.exe
        5⤵
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        5⤵
        
        PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13539.exe
      4⤵
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51310.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6772.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        6⤵
        
        PID:1820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47590.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28096.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        5⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
      4⤵
      PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        5⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47798.exe
        5⤵
        
        PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
      4⤵
      PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29022.exe
      4⤵
      PID:16584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54366.exe
        6⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17958.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        7⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64117.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56814.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32884.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45012.exe
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        6⤵
        
        PID:16380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16380 -s 472
        7⤵
        Program crash
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16550.exe
        6⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        5⤵
        
        PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39492.exe
      4⤵
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4053.exe
        6⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5363.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8395.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2491.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49289.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16708.exe
        5⤵
        
        PID:12936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13764.exe
      4⤵
      PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
      4⤵
      PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50520.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27838.exe
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        6⤵
        
        PID:13992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        6⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23591.exe
        6⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63388.exe
        5⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
      4⤵
      PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15501.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        5⤵
        
        PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64245.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49368.exe
      4⤵
      PID:15784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
    3⤵
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        5⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48374.exe
        5⤵
        
        PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
      4⤵
      PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64784.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
      4⤵
      PID:12444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
      4⤵
      PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22894.exe
      4⤵
      PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42214.exe
    3⤵
    PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
      4⤵
      PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
      4⤵
      PID:9380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23979.exe
    3⤵
    PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
      4⤵
      PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37780.exe
    3⤵
    PID:12344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45276.exe
    3⤵
    PID:16464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40998.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        9⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30244.exe
        9⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20020.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1492.exe
        8⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20914.exe
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14515.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        8⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50037.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16756.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        7⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5436.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        7⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17308.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52645.exe
        8⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19059.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        7⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30083.exe
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35013.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27804.exe
        6⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1496.exe
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26524.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4029.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56165.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6875.exe
        7⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        7⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24045.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62457.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2198.exe
        6⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58412.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64766.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50213.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64732.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
        5⤵
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56384.exe
        5⤵
        
        PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54926.exe
        6⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6668.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60020.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7222.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25491.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        7⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        7⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44781.exe
        6⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35174.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61365.exe
        7⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55942.exe
        6⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18916.exe
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        6⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60197.exe
        7⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51076.exe
        6⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        5⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6245.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48972.exe
        6⤵
        
        PID:16972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53645.exe
        5⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34156.exe
        5⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11323.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        5⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38030.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50300.exe
        7⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44173.exe
        6⤵
        
        PID:15828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22112.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37193.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9283.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23399.exe
        6⤵
        
        PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20131.exe
        5⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37365.exe
      4⤵
      PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37390.exe
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8187.exe
        6⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
        5⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22379.exe
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41220.exe
      4⤵
      PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40630.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49779.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62901.exe
      4⤵
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
      4⤵
      PID:9120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42268.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36804.exe
        6⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31276.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56652.exe
        7⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22853.exe
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        7⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        7⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1355.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22429.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
        6⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        6⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17430.exe
        6⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4828.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        5⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        5⤵
        
        PID:16456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62357.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56582.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52117.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42516.exe
        7⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42420.exe
        6⤵
        
        PID:16040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16040 -s 444
        7⤵
        Program crash
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42561.exe
        6⤵
        
        PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
        6⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27507.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50484.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38108.exe
        5⤵
        
        PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58220.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1588.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39076.exe
        5⤵
        
        PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
      4⤵
      PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48324.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13757.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        5⤵
        
        PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
      4⤵
      PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30492.exe
      4⤵
      PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23654.exe
      4⤵
      PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
      4⤵
      PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33566.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        6⤵
        
        PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        5⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33800.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62845.exe
      4⤵
      PID:7040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 632
        5⤵
        Program crash
        
        PID:10000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 632
        5⤵
        Program crash
        
        PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25003.exe
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      4⤵
      PID:14884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
      4⤵
      PID:16668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44455.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        5⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        5⤵
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33653.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
      4⤵
      PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63964.exe
      4⤵
      PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24947.exe
      4⤵
      PID:7144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33332.exe
    3⤵
    PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
      4⤵
      PID:15128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32249.exe
    3⤵
    PID:10424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
    3⤵
    PID:15092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28308.exe
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
    3⤵
    PID:9132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23806.exe
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50462.exe
        8⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
        8⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33077.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1379.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61460.exe
        7⤵
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26933.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23675.exe
        6⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27956.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1813.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20783.exe
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41622.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20972.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62388.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        5⤵
        
        PID:15984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31880.exe
        5⤵
        
        PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20054.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10261.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        7⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        6⤵
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38932.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21606.exe
        5⤵
        
        PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58173.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        5⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47311.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
      4⤵
      PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3805.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24086.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41225.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47909.exe
        7⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32341.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        6⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15397.exe
        6⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51541.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16571.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64975.exe
        5⤵
        
        PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18932.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13372.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        5⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61662.exe
        5⤵
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61101.exe
    3⤵
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32254.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43718.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64037.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52429.exe
        5⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49844.exe
        5⤵
        
        PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58061.exe
      4⤵
      PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4363.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24083.exe
      4⤵
      PID:14476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
    3⤵
    PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      4⤵
      PID:11996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
      4⤵
      PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      4⤵
      PID:560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
    3⤵
    PID:8544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
    3⤵
    PID:12180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54195.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
    3⤵
    PID:7872
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63037.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26947.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42006.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8484.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        6⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22388.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51109.exe
        6⤵
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47780.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44732.exe
        5⤵
        
        PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14386.exe
        5⤵
        
        PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33519.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31049.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13716.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        6⤵
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17655.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2315.exe
      4⤵
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25870.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
        5⤵
        
        PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10020.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
      4⤵
      PID:13868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47646.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        5⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42900.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37396.exe
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        5⤵
        
        PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60084.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20596.exe
      4⤵
      PID:15156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6435.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57104.exe
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2989.exe
      4⤵
      PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
      4⤵
      PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5595.exe
    3⤵
    PID:12084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43092.exe
    3⤵
    PID:16048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10349.exe
    3⤵
    PID:5840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51014.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53550.exe
        6⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        6⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54717.exe
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63309.exe
        5⤵
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42605.exe
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19539.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53301.exe
      4⤵
      PID:6864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3452.exe
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
      4⤵
      PID:12740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
      4⤵
      PID:16828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56804.exe
    3⤵
    PID:8372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14260.exe
    3⤵
    PID:11864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
    3⤵
    PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16926.exe
    3⤵
    PID:7420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56565.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31886.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37774.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34748.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5259.exe
        5⤵
        
        PID:15860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        5⤵
        
        PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
      4⤵
      PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8591.exe
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43883.exe
      4⤵
      PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8460.exe
    3⤵
    PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
      4⤵
      PID:14996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57444.exe
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58158.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58469.exe
    3⤵
    PID:13852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33608.exe
    3⤵
    PID:9364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14917.exe
  2⤵
  PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4797.exe
    3⤵
    PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
      4⤵
      PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10843.exe
      4⤵
      PID:17024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
    3⤵
    PID:13212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44365.exe
    3⤵
    PID:16736
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
  2⤵
  PID:8072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44796.exe
  2⤵
  PID:11744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
  2⤵
  PID:15892
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24623.exe
  2⤵
  PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7040 -ip 7040
1⤵
PID:9780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7032 -ip 7032
1⤵
PID:10688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7040 -ip 7040
1⤵
PID:12064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7032 -ip 7032
1⤵
PID:12304

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 668 -p 380 -ip 380
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6504 -ip 6504
1⤵
PID:14824

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe

Filesize
468KB

MD5
7cc1a8e00b0b37b0e8d3d55faa3b16fc

SHA1
977f45bcadd3bcb65c9df2e09c814038b0f82176

SHA256
a3970a2e4ac77b5a98456743058804be45f07b3e49da6ee58afa59632566ec91

SHA512
cbe030867d00358bc0c0b9900a1b267a7b0a0516c10593fbb5bc87608be26c379abda7e9416b2315b525eeb7999b718721c7d07202bcf3039619aff689108061

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13293.exe

Filesize
468KB

MD5
a5bf7ecf049d39acd0fc6f7e60f794f0

SHA1
730c585cf375bbf4d9549e7f5189c2f891cf3971

SHA256
4a579b6a16887a666946be8963a2bb92a1d104d29b5ab0a8909249a08a3c1a2d

SHA512
2f43a8d8620fe68528616a9e021d15c7a0badf432e6ad06894bb393c7bd5a694e84b52518815da0ce252f5c659e602878f4f2a2bc4e5eb0c31a19a9994468f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13620.exe

Filesize
468KB

MD5
417fb68447593546cc27f6fde7a350c7

SHA1
63e60bf22bfd1b1bc86ba0d83b4430affb0f8f8a

SHA256
935c60586a711c5833ccf4d57aceeb382e9ca2450c292b33bc4dfceb8a38d5b0

SHA512
b0a1704af81e51dd105f3f0b82934fda200f0ae7d413a08f0dab3d91afa3c47b51a5a0cbd99474acb730e23d76aac488d797add022232d3547ae9d189dbda2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe

Filesize
468KB

MD5
52fa74d0ec091da85adba621def10724

SHA1
cb043b990c14a6665aabd873f50778021dafd084

SHA256
3694c83a1855be367b77d87c264d84870c1a3fe182f1d703ed98f30b4d91ff64

SHA512
da20605528bdc3f99f7ed1519953dca3652cfa362f8fdfc97b355af8628af1d4ec2489558db4b215cebb4551c626a787bcd7e49e6c464954fc746cd816d6917e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe

Filesize
468KB

MD5
278509315863e573b234360112f4675f

SHA1
2ed69ff8bfb59c1b4a24cec7739cd91285579647

SHA256
8b3589bc256b99fe01dc218a606e866daca745872c304edb5fe249fffb9fdd75

SHA512
5b1415b2a0cc9485f43af457c1d9943bde8041206f74cd7c58573b31556f6cae71ba485eff2423cea34656f98d41837a45bc15f6f2acb000b1ee38e05dc17676

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22748.exe

Filesize
468KB

MD5
b887f58aa9499f5e0ba572bd0773e497

SHA1
08ef7f6c98bbe9508fc57251bf14b1edd3dd8bd6

SHA256
b00a624ff1dfa80b30feeab81446f2dad93e6485df4fbdbf731e3983b1669d6f

SHA512
8b37255bfa125a0046e749014de9aa757aba240a17793696fc80b41b574e925daf1c573417a79c5379d9f5fcde25e4104adea4d340248a037f5458693be0d7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23691.exe

Filesize
468KB

MD5
e34ac83a5d775c0eb3b2ead0cdd819e3

SHA1
054b88bf8f0653d866b2aa3130addabb15137ca3

SHA256
fe58bdee9b8b2aa30cc309ab853b45d551f18dfc3a27fe5906ac18d95b9c33ca

SHA512
eeb55898b0b31292fe2cf2d39f4b92242b40b01576b07437c25d6e92ccdcf4207908b8bbdb74a906a3c545f10b9b65b391851fc322ba57b6dcc0a9de6aaf00c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24446.exe

Filesize
468KB

MD5
5ef875eec94e4e802848a9aac8fad82c

SHA1
ab3e59ef9b0f022b62dc45fee4f9b40086f5b811

SHA256
c1a97ed512182d7c4f792c639a3a92f6780f0d397f9f476fc1d390de90019e32

SHA512
99dbfd5d54baf6c7f0a569e7a014a16864655e6fd7aa5f6ad156aebd0a30e87850f30208a5acfab5e8aa58be3f56309d6f8bd6d022327adf7dc8bf6055f76639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25245.exe

Filesize
468KB

MD5
1273a7c111c1f6e99d061a9aef26b028

SHA1
a69b2b166b021dc9f8ff38bf9387a2bd1f190bf4

SHA256
3b2a9796b0bdff3f79929a5b2f2bba37a19c88454a00a24f507ab9314ba4e23c

SHA512
97a0566f25a4a859ad4f263682efe15f0110a87c504d9ea615d02cb8829b769ea9ae1efe1e798637685b4d9b75af8cca19de60233cda55d4e95fa279314575de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26862.exe

Filesize
468KB

MD5
e4e4696bbbe600a3e89ff6ee7876c4bd

SHA1
2de8636fdc2d63dd921fcfe7677d20f67c6d2eb7

SHA256
22d627375d1eb7b7bdb02d4fba68d14d51d0d8b3deceb8f2c24a1e0515e89ea2

SHA512
27d8ab32e88b046b3048fc9a279e5508a4edbc83ecfb04272e54e22a597b63f7abd986757f274198c0fd86e0fa407c30b4c4a286373cebdb2612deaf354c266b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27932.exe

Filesize
468KB

MD5
3b8612ded1eedf916636fcad6e936a66

SHA1
92dcade0738d7869b6c32d46baad3f771fc683bf

SHA256
a8f2ba7153d1af332232d8d53bf49d65822b556762c205f806c3c39d0eb5c448

SHA512
261734ba61bf9bf1d80b0810e4df5ac8a3d3f5f0d8ca6d113548490101bbebc95fe270a0817489e4b12ff14eed099e19af8ec39a904a4f7cf69aed0cb7ffe018

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe

Filesize
468KB

MD5
bfb03692f2bce59ba61d60d5a522ac6e

SHA1
c572d3e924eac8b4e978254cc9a60e1a5d8892c1

SHA256
9071fe4eacfd0393d51329cfb36561f8a6e77af3d4042cc984833365c1018030

SHA512
25f6011be3195abb5d1c8e1783f05bba3859348fa3e81770143d4a811eeb5a2e64e00e260251983499e7e2026fb01d48b9fc16279d5a2a1dbe2b735ac65d51ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31270.exe

Filesize
468KB

MD5
ed47f0d917c5adbf615e8b5d8268a24f

SHA1
a40c7e76f862e1b1e979291b7471a0c705220b6e

SHA256
5360ade11dabe858c715562007d075806fd932ad4d118ac06e0289161c67bb08

SHA512
4e46170461f3665ae7748bcfcd2cb2b8db6e52691c31b0f337ac46bc5c3c0c204ee2c95ab66f0ef2b77a66b2f069e2aa338d62e196772873cb9426dd47b70904

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33486.exe

Filesize
468KB

MD5
bb462d6f0a71080e4c27438f23bc961e

SHA1
c1f84de7c37ef6b3bff067594c5eec4f6d524b73

SHA256
ac3ee7514ef2438c138532ddca9a3e702ffcc3ca3d7656ec2f1e5f960286f20a

SHA512
04e74b7c02d3f5a1af3c62ac59829b9fc09787d7e0f98e3d12f8c759ebeaff6de529468f4fbf0e7cdaff06abd3e0fe98fc0355c4936d50e6139113d1333ed86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34062.exe

Filesize
468KB

MD5
4aeb67c39a9f635835bb44c33755634c

SHA1
c071fc23bf6f8c6a600587aadbc01e35aa4e899c

SHA256
bbc46086e19b77b5de83949c9324aa2b9af6abcb69087c454de0795a9b016ae1

SHA512
8bf4f7a016fa4ff9932c4705177ba59c6c17781df8ab7b526451facf6365ed75aaff9fa2128510f805608851191f35828f2c3d6a76f765deefe4b6a8dcd50700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34518.exe

Filesize
468KB

MD5
46c749aa1376a1adba7cda95c9401430

SHA1
d47da30d2db268f3629b33d1c8d6c2f666d21c78

SHA256
ee530baed07f4f4072cfe94c1c45a7725223933d86c4e99dcf47141cb69e85fa

SHA512
6a6bb4612ad924994fb87e6a0e41346a6e87fe5f77de4487c6e9b1d3d08a297284ec5e04243eea086a0532cae317550bde1bbeec16abeb71756a04a28f560e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35908.exe

Filesize
468KB

MD5
0ffa7a7179f361d8208094bcb6bf88c5

SHA1
ea1e293841a93e11fc52674c913e74ef5b40934a

SHA256
e4c3ae1e71cd1071830c6affee60adb7851b216b41d0256a8c089ad8746957f8

SHA512
926f9fd1b0f23365a6220759030e1a60b8bd3cbf226e0bc2e79ab99ff4b7e62f77674c79251fd19902b51808ffd1367a54318b8218a30bbdade4a8571cb6020a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40777.exe

Filesize
468KB

MD5
2d99a6d998c8b415797d04b32a9f979a

SHA1
9d00f88dec840bfe6706a8bb504b2297f54133bb

SHA256
392726817002b0e58121548b8c18d435f47aa97fe299603b340c611a76c6e590

SHA512
05b82034fd351cd310f9f0eb657c4f90058085bcb633f6899f03cff10e9d483a14bdc271f46db88dc8de44ebc676144eb5cf2db1f76cf98b3f4e46ddaaf34857

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe

Filesize
468KB

MD5
93fb562a3ee554ac9f729fa4d0ece23d

SHA1
1a4df93ae97f60c6c48ceeac2c240189b132d1ad

SHA256
bebcfeba65903001b7b6b4b656668c2de91f617a662b3efeaf79af26dd3c3117

SHA512
a59ccd5effa4a80b3a07e72cd583d3d58ae5246944a0efab3b9af2d38cb78f5cb787a9d1cf5421268a2b0379d9c1a8abd5ef1969b637a2350fc747996075dfb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41846.exe

Filesize
468KB

MD5
e38c9ea1b822d3adc08732a61a470a83

SHA1
372b3954327510bfaab8865e47d24a5ea5b10ebd

SHA256
22398af53036cbcf7e355e14af83c1a8b6159df1a393f32e1c05a9715f71f9fb

SHA512
30d0b2e472fc5feeb1d4655ee39678d48ef0f8aee702c3c83cb98aa20b00e634cec7546ad50437b4d906a927a4890ddc53ffe99765b5114dbb8afff4f8fad38e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53973.exe

Filesize
468KB

MD5
43d7513c7dc05f44f52476f263cd980c

SHA1
c38abe92cca89c515cd6ec3e18cb3888153ca602

SHA256
e922f3d9bee4b875330af0ef8a46ad19076f0ba88e34ce6bc5b1f300ff77efcc

SHA512
ad895295c91b408bb79288630cef53def809139fcc94606fac186925aec06bc664160b0ea12d34440d010da380b4ff77e58f9681fd2ca60cfc9975a1c396facf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56005.exe

Filesize
468KB

MD5
3a2e66439ddb5a09ba93c57362eb10ae

SHA1
0500ec49ad2f7226adf9839abcdbd742acb357dc

SHA256
d343f53434b24f7ac781a65c3daede0981bb0ce261407ed1c8b6587797b771f2

SHA512
1418f98b96ef804a1d3485f5804adcdd76bd2a1976d256bba299b44070574e91d10b6d3222d9127cf68005a7e9d326de680fe0f54e9e41d9b5fa082094fd227a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5644.exe

Filesize
468KB

MD5
3b577b7ba88d059e1f37d45257c028c2

SHA1
65e96399ef9413fca064c4d974cc9ce5fac40b6f

SHA256
af1f205391e3bc109164f2f9621ae0c6071eee1d0f70005cadf8f1c88e3e531d

SHA512
3765253d7de62c02c7f1c52a3be346e4393b3a2c33d6808996497d4c43915577a322094747a4ba0809653bac5de581d31dad59c3abcc5225714488c0583e280c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe

Filesize
468KB

MD5
1ab275909ea6aa9170bee961e6af100c

SHA1
d924023daea0a0ca096b5b3ca455fd395d62bda7

SHA256
fb51931ab9d5c1a900744691eaecfb70eb65bff90cda18b69a75cc3dc80730d6

SHA512
df8f498b9d28a7d3a3c49c801daa292cce51e2c986b9a447116ad8c1747739b9b88a91cc5c3208ec7c38507959a027eecc83e9f42ba823be090739c94c0d6bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57798.exe

Filesize
468KB

MD5
6adf2c2ecf367bb8e5dc875f9d259c56

SHA1
7e7a25a334c64ffc42d92a0676a05d3444286567

SHA256
64e0416b71d7d789aca975ed76021cb8612cf55632821b2596490f724093dc0e

SHA512
0c15c17661fad9d731ea238d9dc0355f44c661787acfe9fbe711852382089e32888f958ed5babb8644ea7aa30881b947eec92db9b13c2c07aaa1f38c52c45e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58688.exe

Filesize
468KB

MD5
8126a6f83dda0272b5a9af8ce04b836d

SHA1
371029cd72b7f9a75e795d87f1667a5a5d9a97e0

SHA256
633a84679ab1404f209258579cb12bbd8b065688cff049782cee5d82775c520c

SHA512
caffa710f013d7dcf5781f33e1a28b516caa58aa829bfc862c2d403dc66b0f6bc806881955545db51ec0e1c00d32f23169f0cfe87d1ca2ee4f37ba9d37b13239

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59342.exe

Filesize
468KB

MD5
942f87b49b47fefcb01ffef67e59a2b7

SHA1
480cc0dd1af642bde4c0d4d0bb2180f31567fc9c

SHA256
ac9072d6bba9114c208a32c3b728c742133ea160f17a178b3e397352459b0015

SHA512
d871b637cc46bca0ad83f676eede69e0cefb92421e21351fc3a20b1d5dd6a9f04b3af55c8cb8f9f51258efd0f6c9494bf5e6ea143acd3246868695366f1649c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe

Filesize
468KB

MD5
cfc8718800734cbe9f78982e8b4fab92

SHA1
30b797631c56ed2c6e618d9e373d380da4971b49

SHA256
8e1da6b33a14c8d02d525a11612fd552d7748fe7942b25c809ff7dd9e6468650

SHA512
5b379bfc54cc579a44fd0059b5307c87efe3c52346951a290a22b4e6a1cb03aecba837747b2e47eecf6e6c7d8f6c8c5d1f4015b4a9d5d405faa0f9239e45c5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe

Filesize
468KB

MD5
99cd16b0af6e761e262c2288f1488f1b

SHA1
cf8c5c379eee44335ebf03cc68cd06ddde745292

SHA256
f267f8c7fe0634149beaf4ef1898ae204107a64a3942f0b81b88dd06d184fd25

SHA512
d1a46755eaf8fe791681f2aec8368b12602852338970394571ad88ee0efccfb65ddafd30998229dcea3f29a9141ffd9bbf0ca354337ce47e23d3b329299d8307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6500.exe

Filesize
468KB

MD5
eff56de59756682ce257dfa01ae35e8e

SHA1
c497282c2c39ce6be36b93dee3915d5374977139

SHA256
4da8eb0735b9de487361b4eb30a6e29e945206f96f84978652fd48185a8b3e04

SHA512
d3e80f8ca0713225830661400ed8a6e0c9dd0f40e0376d17198e02083e69b10f0731edcb7f9f4835ea19665989ed6b37cd595ac1d585866394afe27df990b93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8301.exe

Filesize
468KB

MD5
8540c80c5b3880bd9a20e35aa11a093e

SHA1
17b250622f0069071548adc5f458cd13ebaea57a

SHA256
b8784feddb6e9696f9919690ba9a95ec053b84d7da75e3f6104406e827614de4

SHA512
5a94a21194f949d381db545a95b5ac4db6656fc5756940e5adaf4a578d5b92e9a68664b86dd0ce4612aa7ec3f7e826ceb2410050223689180809e3c6f814c69a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads