8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785

Analysis

max time kernel
110s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe
Size

468KB
MD5

54fbc743ee5391cbbf6d8aea54c288a0
SHA1

f87ba14df82b3024e18ff91484de5508ec2796a3
SHA256

8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785
SHA512

11324a3c00ee399dff02b7d4bf2a3ff4d3a8c575abf1f85e25ba12635c0c50fdf997d7e35ef3f276f9eab2f18115ea7f7f4cc29fa13a836da9256162b40cfc69
SSDEEP

3072:4geKogI/IM57tbYEpzcjVfD/EzLnaIpcQGHeQVYImc0LwLkuRXll:4groKk7t7p4jVfv05OmcOykuR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2664	Unicorn-24085.exe
4240	Unicorn-58677.exe
4388	Unicorn-22283.exe
4612	Unicorn-16057.exe
4948	Unicorn-8443.exe
3232	Unicorn-28309.exe
3992	Unicorn-56003.exe
1832	Unicorn-64017.exe
1208	Unicorn-39513.exe
452	Unicorn-33382.exe
5056	Unicorn-52320.exe
2344	Unicorn-6648.exe
4472	Unicorn-6383.exe
960	Unicorn-6648.exe
2096	Unicorn-2822.exe
4660	Unicorn-10104.exe
2448	Unicorn-47800.exe
4372	Unicorn-47245.exe
760	Unicorn-51329.exe
2032	Unicorn-35547.exe
4376	Unicorn-58921.exe
1748	Unicorn-58921.exe
2248	Unicorn-58921.exe
1084	Unicorn-39055.exe
1564	Unicorn-1552.exe
1236	Unicorn-50488.exe
1888	Unicorn-44623.exe
2312	Unicorn-41823.exe
376	Unicorn-34971.exe
4640	Unicorn-36109.exe
2084	Unicorn-44012.exe
988	Unicorn-57105.exe
3056	Unicorn-44853.exe
3280	Unicorn-4375.exe
3336	Unicorn-14218.exe
1948	Unicorn-57873.exe
3740	Unicorn-11994.exe
3152	Unicorn-33561.exe
536	Unicorn-45813.exe
4784	Unicorn-25201.exe
1300	Unicorn-35075.exe
4692	Unicorn-54941.exe
3284	Unicorn-17993.exe
2072	Unicorn-30245.exe
4152	Unicorn-10379.exe
1464	Unicorn-34521.exe
4068	Unicorn-59580.exe
1244	Unicorn-13643.exe
2320	Unicorn-59580.exe
3048	Unicorn-13908.exe
3160	Unicorn-7778.exe
4772	Unicorn-49003.exe
3168	Unicorn-14847.exe
1844	Unicorn-9247.exe
3196	Unicorn-28582.exe
4164	Unicorn-18761.exe
1540	Unicorn-22845.exe
5100	Unicorn-7063.exe
2724	Unicorn-59031.exe
2188	Unicorn-2040.exe
1788	Unicorn-39735.exe
3980	Unicorn-43265.exe
1412	Unicorn-2232.exe
864	Unicorn-47904.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
15652	16236	WerFault.exe	777
9492	15420	WerFault.exe	789
16908	17132	WerFault.exe	825
3816	15792	WerFault.exe	768

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59699.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8563.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4467.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63377.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6648.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	9468	dwm.exe
Token: SeChangeNotifyPrivilege	9468	dwm.exe
Token: 33	9468	dwm.exe
Token: SeIncBasePriorityPrivilege	9468	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe
2664	Unicorn-24085.exe
4240	Unicorn-58677.exe
4388	Unicorn-22283.exe
4948	Unicorn-8443.exe
4612	Unicorn-16057.exe
3232	Unicorn-28309.exe
3992	Unicorn-56003.exe
1208	Unicorn-39513.exe
1832	Unicorn-64017.exe
960	Unicorn-6648.exe
2344	Unicorn-6648.exe
452	Unicorn-33382.exe
4472	Unicorn-6383.exe
5056	Unicorn-52320.exe
2096	Unicorn-2822.exe
4660	Unicorn-10104.exe
2448	Unicorn-47800.exe
4372	Unicorn-47245.exe
760	Unicorn-51329.exe
2032	Unicorn-35547.exe
1084	Unicorn-39055.exe
4376	Unicorn-58921.exe
1564	Unicorn-1552.exe
1236	Unicorn-50488.exe
2248	Unicorn-58921.exe
1888	Unicorn-44623.exe
1748	Unicorn-58921.exe
2312	Unicorn-41823.exe
376	Unicorn-34971.exe
4640	Unicorn-36109.exe
2084	Unicorn-44012.exe
988	Unicorn-57105.exe
3056	Unicorn-44853.exe
3280	Unicorn-4375.exe
3336	Unicorn-14218.exe
1948	Unicorn-57873.exe
3740	Unicorn-11994.exe
3152	Unicorn-33561.exe
536	Unicorn-45813.exe
4784	Unicorn-25201.exe
1300	Unicorn-35075.exe
3284	Unicorn-17993.exe
2072	Unicorn-30245.exe
4152	Unicorn-10379.exe
4692	Unicorn-54941.exe
4772	Unicorn-49003.exe
4068	Unicorn-59580.exe
2320	Unicorn-59580.exe
3048	Unicorn-13908.exe
1244	Unicorn-13643.exe
3160	Unicorn-7778.exe
1844	Unicorn-9247.exe
3196	Unicorn-28582.exe
3168	Unicorn-14847.exe
1464	Unicorn-34521.exe
1540	Unicorn-22845.exe
2724	Unicorn-59031.exe
5100	Unicorn-7063.exe
4164	Unicorn-18761.exe
2188	Unicorn-2040.exe
860	Unicorn-46263.exe
864	Unicorn-47904.exe
3980	Unicorn-43265.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2664	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	82
PID 1008 wrote to memory of 2664	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	82
PID 1008 wrote to memory of 2664	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	82
PID 2664 wrote to memory of 4240	2664	Unicorn-24085.exe	83
PID 2664 wrote to memory of 4240	2664	Unicorn-24085.exe	83
PID 2664 wrote to memory of 4240	2664	Unicorn-24085.exe	83
PID 1008 wrote to memory of 4388	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	84
PID 1008 wrote to memory of 4388	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	84
PID 1008 wrote to memory of 4388	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	84
PID 4240 wrote to memory of 4612	4240	Unicorn-58677.exe	85
PID 4240 wrote to memory of 4612	4240	Unicorn-58677.exe	85
PID 4240 wrote to memory of 4612	4240	Unicorn-58677.exe	85
PID 2664 wrote to memory of 4948	2664	Unicorn-24085.exe	86
PID 2664 wrote to memory of 4948	2664	Unicorn-24085.exe	86
PID 2664 wrote to memory of 4948	2664	Unicorn-24085.exe	86
PID 4388 wrote to memory of 3232	4388	Unicorn-22283.exe	87
PID 4388 wrote to memory of 3232	4388	Unicorn-22283.exe	87
PID 4388 wrote to memory of 3232	4388	Unicorn-22283.exe	87
PID 1008 wrote to memory of 3992	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	88
PID 1008 wrote to memory of 3992	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	88
PID 1008 wrote to memory of 3992	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	88
PID 4948 wrote to memory of 1832	4948	Unicorn-8443.exe	93
PID 4948 wrote to memory of 1832	4948	Unicorn-8443.exe	93
PID 4948 wrote to memory of 1832	4948	Unicorn-8443.exe	93
PID 2664 wrote to memory of 452	2664	Unicorn-24085.exe	94
PID 2664 wrote to memory of 452	2664	Unicorn-24085.exe	94
PID 2664 wrote to memory of 452	2664	Unicorn-24085.exe	94
PID 3232 wrote to memory of 1208	3232	Unicorn-28309.exe	95
PID 3232 wrote to memory of 1208	3232	Unicorn-28309.exe	95
PID 3232 wrote to memory of 1208	3232	Unicorn-28309.exe	95
PID 4388 wrote to memory of 5056	4388	Unicorn-22283.exe	97
PID 4388 wrote to memory of 5056	4388	Unicorn-22283.exe	97
PID 4388 wrote to memory of 5056	4388	Unicorn-22283.exe	97
PID 3992 wrote to memory of 2344	3992	Unicorn-56003.exe	98
PID 3992 wrote to memory of 2344	3992	Unicorn-56003.exe	98
PID 4612 wrote to memory of 960	4612	Unicorn-16057.exe	99
PID 4612 wrote to memory of 960	4612	Unicorn-16057.exe	99
PID 4612 wrote to memory of 960	4612	Unicorn-16057.exe	99
PID 3992 wrote to memory of 2344	3992	Unicorn-56003.exe	98
PID 1008 wrote to memory of 4472	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	96
PID 1008 wrote to memory of 4472	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	96
PID 1008 wrote to memory of 4472	1008	8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe	96
PID 4240 wrote to memory of 2096	4240	Unicorn-58677.exe	101
PID 4240 wrote to memory of 2096	4240	Unicorn-58677.exe	101
PID 4240 wrote to memory of 2096	4240	Unicorn-58677.exe	101
PID 1832 wrote to memory of 4660	1832	Unicorn-64017.exe	102
PID 1832 wrote to memory of 4660	1832	Unicorn-64017.exe	102
PID 1832 wrote to memory of 4660	1832	Unicorn-64017.exe	102
PID 4948 wrote to memory of 2448	4948	Unicorn-8443.exe	103
PID 4948 wrote to memory of 2448	4948	Unicorn-8443.exe	103
PID 4948 wrote to memory of 2448	4948	Unicorn-8443.exe	103
PID 1208 wrote to memory of 4372	1208	Unicorn-39513.exe	104
PID 1208 wrote to memory of 4372	1208	Unicorn-39513.exe	104
PID 1208 wrote to memory of 4372	1208	Unicorn-39513.exe	104
PID 960 wrote to memory of 760	960	Unicorn-6648.exe	105
PID 960 wrote to memory of 760	960	Unicorn-6648.exe	105
PID 960 wrote to memory of 760	960	Unicorn-6648.exe	105
PID 3232 wrote to memory of 2032	3232	Unicorn-28309.exe	106
PID 3232 wrote to memory of 2032	3232	Unicorn-28309.exe	106
PID 3232 wrote to memory of 2032	3232	Unicorn-28309.exe	106
PID 5056 wrote to memory of 4376	5056	Unicorn-52320.exe	107
PID 5056 wrote to memory of 4376	5056	Unicorn-52320.exe	107
PID 5056 wrote to memory of 4376	5056	Unicorn-52320.exe	107
PID 2344 wrote to memory of 1748	2344	Unicorn-6648.exe	110

C:\Users\Admin\AppData\Local\Temp\8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe
"C:\Users\Admin\AppData\Local\Temp\8bac66b92dd3e6a6b692260aa732ae720236a308483f1eb95731d78f30026785N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        8⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6804.exe
        9⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        10⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        10⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41700.exe
        10⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        9⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49131.exe
        9⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57544.exe
        9⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        9⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        9⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        9⤵
        
        PID:16868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        9⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62763.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37187.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51213.exe
        9⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        9⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        9⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36880.exe
        8⤵
        
        PID:13184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4243.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57847.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11908.exe
        8⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52884.exe
        8⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16038.exe
        8⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41964.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15919.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        7⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        7⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        7⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52777.exe
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3732.exe
        9⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16126.exe
        9⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        9⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        9⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60023.exe
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47404.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        8⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
        8⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62061.exe
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        8⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41467.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        7⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        7⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48955.exe
        7⤵
        
        PID:1176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63039.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36880.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58756.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        7⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59771.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46131.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38081.exe
        6⤵
        
        PID:16104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30245.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19611.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
        8⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17922.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        7⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11110.exe
        7⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
        7⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51516.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        7⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        6⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22201.exe
        6⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49003.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        6⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57617.exe
        8⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53060.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65084.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        7⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12920.exe
        7⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50992.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26302.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5048.exe
        6⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13171.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
        6⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        7⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18419.exe
        7⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        6⤵
        
        PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52799.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26185.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9023.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25813.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-546.exe
        5⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28124.exe
        5⤵
        
        PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9160.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2092.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50969.exe
        9⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22131.exe
        9⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        9⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9147.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        8⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        8⤵
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        8⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11467.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7102.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30864.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26164.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        7⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        7⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        6⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34302.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6450.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10092.exe
        6⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42601.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26871.exe
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        8⤵
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9340.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        7⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53399.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        7⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        6⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16818.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
        6⤵
        
        PID:14544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        6⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54249.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29176.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39641.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63344.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40415.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64908.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22845.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25689.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6560.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21999.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        7⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50985.exe
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30315.exe
        7⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24806.exe
        7⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3414.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46183.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4898.exe
        6⤵
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43116.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        5⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13831.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59031.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54669.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        7⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65415.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47100.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53533.exe
        6⤵
        
        PID:15792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15792 -s 468
        7⤵
        Program crash
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6076.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46107.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56685.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50132.exe
        6⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61523.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7767.exe
        5⤵
        
        PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14600.exe
      4⤵
      PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35048.exe
        5⤵
        
        PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8122.exe
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62860.exe
      4⤵
      PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
      4⤵
      PID:17504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
        9⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        10⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55612.exe
        10⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29479.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        9⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62313.exe
        9⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44744.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11503.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46612.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60179.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21039.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12602.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48879.exe
        7⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        7⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39735.exe
        6⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        8⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52028.exe
        8⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24302.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49123.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        7⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62466.exe
        7⤵
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40267.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60229.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
        6⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        8⤵
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46289.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        7⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17492.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
        6⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62069.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27803.exe
        7⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56303.exe
        7⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50991.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62240.exe
        6⤵
        
        PID:15420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15420 -s 464
        7⤵
        Program crash
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10736.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12131.exe
        7⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58141.exe
        7⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        6⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3415.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15608.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        6⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17541.exe
        6⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9802.exe
        5⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29795.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49409.exe
        5⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        5⤵
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44625.exe
        8⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47056.exe
        9⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50859.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        9⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37543.exe
        8⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        8⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        7⤵
        
        PID:17920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49352.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        7⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38739.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36967.exe
        6⤵
        
        PID:16492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5643.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5882.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        7⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        7⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19154.exe
        6⤵
        
        PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34455.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
        5⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9667.exe
        5⤵
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14218.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27033.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65185.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14771.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1134.exe
        7⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54457.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46472.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37944.exe
        6⤵
        
        PID:15732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64463.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        6⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52284.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58504.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
        5⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53520.exe
        5⤵
        
        PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48044.exe
      4⤵
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40055.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39967.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
        6⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37491.exe
        5⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13448.exe
        6⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64316.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23511.exe
        5⤵
        
        PID:17324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
      4⤵
      PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35645.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        5⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46861.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      4⤵
      PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
      4⤵
      PID:17556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16959.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23333.exe
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
        8⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33387.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        8⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        7⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24931.exe
        7⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41051.exe
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39543.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        6⤵
        
        PID:13776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        6⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33829.exe
        6⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7979.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63504.exe
        5⤵
        
        PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21193.exe
        7⤵
        
        PID:13340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        7⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46673.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60460.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        5⤵
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      4⤵
      PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42077.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41435.exe
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62064.exe
        5⤵
        
        PID:14540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7123.exe
      4⤵
      PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      4⤵
      PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37772.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27313.exe
        5⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13990.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59677.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe
        7⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14715.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24514.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        6⤵
        
        PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18157.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40351.exe
        6⤵
        
        PID:16236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16236 -s 464
        7⤵
        Program crash
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
        6⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62379.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        5⤵
        
        PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      4⤵
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38827.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55297.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        6⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38451.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6947.exe
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63377.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22203.exe
      4⤵
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54033.exe
      4⤵
      PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21618.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11994.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
      4⤵
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31693.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14072.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14975.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        6⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42831.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44267.exe
        6⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35379.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        5⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        5⤵
        
        PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19693.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        5⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        5⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21472.exe
        5⤵
        
        PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59063.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49803.exe
      4⤵
      PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21384.exe
      4⤵
      PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2039.exe
    3⤵
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38709.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55953.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59381.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20315.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46096.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        5⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        5⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        5⤵
        
        PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12699.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        5⤵
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20718.exe
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      4⤵
      PID:14060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      4⤵
      PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      PID:2880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5512.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44265.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25690.exe
      4⤵
      PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
      4⤵
      PID:8988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27086.exe
    3⤵
    PID:7856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
    3⤵
    PID:11560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27563.exe
    3⤵
    PID:15692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
    3⤵
    PID:8848
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47245.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        9⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61732.exe
        9⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        9⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        8⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45624.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56641.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62277.exe
        9⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13841.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42343.exe
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59656.exe
        7⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47572.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25895.exe
        6⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2720.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        9⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        8⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52435.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61960.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53067.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53139.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        7⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60876.exe
        7⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30336.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62667.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58909.exe
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51115.exe
        5⤵
        
        PID:1304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27609.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30017.exe
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16689.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30531.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-994.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57255.exe
        7⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        7⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29221.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19239.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5254.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        6⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58564.exe
        6⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44064.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23821.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55437.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41975.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
        7⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29830.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        5⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34521.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25121.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13091.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13126.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        7⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28738.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9007.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        6⤵
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16679.exe
        5⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57985.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21960.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
        6⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8276.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34180.exe
        6⤵
        
        PID:16932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45595.exe
        5⤵
        
        PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7778.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41293.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15653.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57041.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        8⤵
        
        PID:17140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30212.exe
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        7⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39131.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17108.exe
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5024.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24346.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40859.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        5⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23058.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3040.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23823.exe
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34037.exe
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42991.exe
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
      4⤵
      PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49938.exe
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15247.exe
      4⤵
      PID:13048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25201.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-68.exe
        6⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29781.exe
        8⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45203.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        8⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64404.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11650.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12900.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23230.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17388.exe
        7⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5795.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37550.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16763.exe
        6⤵
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54100.exe
        5⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4856.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32968.exe
        7⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        6⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15142.exe
        5⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29164.exe
        6⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50019.exe
        6⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36863.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        5⤵
        
        PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5460.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10580.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64736.exe
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2635.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26487.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38939.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23196.exe
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        5⤵
        
        PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49107.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38437.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12723.exe
        6⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28466.exe
        5⤵
        
        PID:13984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        5⤵
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33291.exe
        5⤵
        
        PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22736.exe
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
      4⤵
      PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64401.exe
      4⤵
      PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16574.exe
      4⤵
      PID:16424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17993.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42417.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9303.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62307.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41539.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23777.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50933.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10611.exe
        7⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39303.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19950.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28904.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        5⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7575.exe
        5⤵
        
        PID:17928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2123.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37788.exe
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57483.exe
        5⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        5⤵
        
        PID:424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25359.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4467.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26090.exe
        5⤵
        
        PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25282.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4371.exe
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13643.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        6⤵
        
        PID:12976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57071.exe
        6⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26635.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34758.exe
        5⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42189.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17446.exe
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12558.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
      4⤵
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63603.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24589.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-715.exe
        5⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42589.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25395.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63023.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51784.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13290.exe
      4⤵
      PID:16672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
    3⤵
    PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
    3⤵
    PID:15104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
    3⤵
    PID:4044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8428.exe
        6⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59845.exe
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39083.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52028.exe
        7⤵
        
        PID:17132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17132 -s 460
        8⤵
        Program crash
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3135.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31922.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        6⤵
        
        PID:15084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3963.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30370.exe
        6⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5823.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17638.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20875.exe
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1205.exe
        6⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20622.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49679.exe
        5⤵
        
        PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14847.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12512.exe
        5⤵
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20787.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12530.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32776.exe
        7⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53984.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54145.exe
        6⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12123.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33097.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35832.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51125.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56315.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
        5⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7056.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        6⤵
        
        PID:17268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30091.exe
        6⤵
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62048.exe
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        5⤵
        
        PID:14124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18223.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16623.exe
        5⤵
        
        PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32300.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19657.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2495.exe
        5⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26910.exe
        5⤵
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17918.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8747.exe
      4⤵
      PID:14068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5932.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7204.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        5⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41641.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57056.exe
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12967.exe
        6⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52728.exe
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65467.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        5⤵
        
        PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41655.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34470.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        5⤵
        
        PID:13020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48887.exe
        5⤵
        
        PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1119.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48059.exe
      4⤵
      PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53304.exe
      4⤵
      PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45377.exe
      4⤵
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58857.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38757.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        5⤵
        
        PID:9600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64638.exe
        5⤵
        
        PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20718.exe
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      4⤵
      PID:14080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5402.exe
      4⤵
      PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12979.exe
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5600.exe
      4⤵
      PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
        5⤵
        
        PID:13228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        
        PID:16680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4895.exe
        5⤵
        
        PID:7080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51140.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
      4⤵
      PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25902.exe
      4⤵
      PID:16692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
    3⤵
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63465.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56095.exe
      4⤵
      PID:12604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45539.exe
    3⤵
    PID:9780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
    3⤵
    PID:12572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
    3⤵
    PID:16432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
    3⤵
    PID:6652
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54941.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26981.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1384.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28955.exe
        7⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48327.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48592.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8046.exe
        6⤵
        
        PID:13812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42823.exe
        5⤵
        
        PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12846.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51708.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4752.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22298.exe
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6258.exe
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33267.exe
      4⤵
      PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46130.exe
      4⤵
      PID:928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50769.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11952.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45557.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57996.exe
        6⤵
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44459.exe
        6⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6983.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28082.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
        5⤵
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64012.exe
      4⤵
      PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26253.exe
        5⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39707.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31748.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39833.exe
      4⤵
      PID:18040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
    3⤵
    PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44765.exe
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7855.exe
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61051.exe
      4⤵
      PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    3⤵
    PID:8300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
    3⤵
    PID:11476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20091.exe
    3⤵
    PID:15756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24640.exe
    3⤵
    PID:2556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43561.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31502.exe
        5⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21430.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2759.exe
      4⤵
      PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52639.exe
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24296.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4518.exe
      4⤵
      PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
    3⤵
    PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22241.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
      4⤵
      PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
      4⤵
      PID:18004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64815.exe
    3⤵
    PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
    3⤵
    PID:12280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
    3⤵
    PID:1468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9247.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49461.exe
    3⤵
    PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55761.exe
      4⤵
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
        5⤵
        
        PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22551.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63496.exe
      4⤵
      PID:13624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21546.exe
      4⤵
      PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
      4⤵
      PID:8904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9724.exe
      4⤵
      PID:15612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43215.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    3⤵
    PID:13276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
  2⤵
  PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1599.exe
    3⤵
    PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17633.exe
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46548.exe
      4⤵
      PID:14532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
    3⤵
    PID:10448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3351.exe
    3⤵
    PID:13252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
    3⤵
    PID:856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31798.exe
  2⤵
  PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47337.exe
    3⤵
    PID:15908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60603.exe
    3⤵
    PID:3508
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12003.exe
  2⤵
  PID:9808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3147.exe
  2⤵
  PID:14032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21068.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21068.exe
  2⤵
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42080.exe
  2⤵
  PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 16236 -ip 16236
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 15420 -ip 15420
1⤵
PID:9532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 15792 -ip 15792
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 17132 -ip 17132
1⤵
PID:4172

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe

Filesize
468KB

MD5
76cfce616d8d12e71e231043f4e550da

SHA1
8063dc4aedd7a555a41903542274d1e99622ea00

SHA256
d22f5ad01970f72708c0bf2b75805a021fc60df050db7f97584ee35433506fd5

SHA512
8a53758482d5c9fff61875e0125c29b5bd9fd3070a85ec190c7bce00e704c4d5a441cdf8ccf9370fcff0ed08e1ee20da1aa118c959634882a06699119819b518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe

Filesize
468KB

MD5
4b3f9ef54961dcf28390bc12a2111365

SHA1
29aabc6bb5aa4e4c8cd7964bd97880ab478ea439

SHA256
abfaaa7d603e75ec241d034546f959885cc7add08360fd16e481181d4dd34b68

SHA512
7d47476e28e9c21c90b7f0caebbb07453a3be39eb0868deaa810d58ce37729a52615198d58b0cd916909c04635265a65dae46c86ca2b69246503d693cb3f314e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16057.exe

Filesize
468KB

MD5
ab141963f3c57b482e53b57b2255597d

SHA1
ed0bc9881038e8569889570070be986946d15909

SHA256
c33c670e8902134efa905c25eaf7053365009c5944712d7837f91cd11ad00599

SHA512
90b80ac03fc9dffc9ddef28ae247f05fed4a7c58b9e68180ba26702e8c7e86257f851374ab2377949228cec2444e5764962f1fa1166291b02cb1ae76b5c0a882

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18349.exe

Filesize
468KB

MD5
e12d42af63ba980d4978a965a36f3e9c

SHA1
90317637599cd32e78e11eb502e4f7daa23200c0

SHA256
bda6fc9f7a539eaaf56f9ce86e0154f3d49de88dacf334fd81452b83006563ee

SHA512
a41fe92c8a38fc5677c94055fb43ab21d9fb054f18af085077f154ed8c14a4b23ce7a8c10d47ad7699b5f609ff69a1317a1117751ac8dd6f0a4b3efa9297ed8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe

Filesize
468KB

MD5
e27d0a9fbdf1ec59a12a223db585be50

SHA1
c84fd8e391d9ecf67a67cebb9d3d18e06dc83c6c

SHA256
0525d3bf3407311b41ae35710348377a46b5bd6d4fae6ed6ea70e18aafdfad5f

SHA512
a4e7105e26a1c6154b5a68066e6e703e3d2173f0afe3b3f2c3674c4187815ac9082c757148784a0174cad658d3aec5cff54db32cf9e6cd19270a9e47078a6ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe

Filesize
468KB

MD5
73d6f9753a5b3619111cbb829c70b9ec

SHA1
694df2fdfe6f1a0914ccafcf95a639446e5a93a9

SHA256
71fd861f2edfa0fc86ab09b7c0745d1bff85fd8c1c3941b1f77b016d566812d4

SHA512
1a6f173d09d88d7392dfa771b41a1b1f61f20334c2e236448fb73de058885bbef73e51fbce1e5a75444a8c2de5c944121772d6f400a911f1dbc3afb89a0d9d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe

Filesize
468KB

MD5
3fd07aceae760bc07e9635a8dc439d9c

SHA1
34da635646aecc20ee9b3ccbcef9a3920ae67b29

SHA256
ea09fd8ad89054ab643b61d47b5ff31473b854eddb4e75c1bbefb639a634e247

SHA512
026d980abebce0fa1838bc7e2798d154e91a723ff7d238d361ed7692c6f892d5b3c018d252e94ad85382dd22e40d6e0dbdf5a15fcbd99e95e777ec74ad3c0545

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28309.exe

Filesize
468KB

MD5
3f5efa8268e325b3c7f22cbc9e81c108

SHA1
b11a15f79434f0705b397882ff41f164fe81b1d7

SHA256
af64bbac8fd8cef275c8f976f4cc4e73984ce9b53f08fbf03c9998281784f87d

SHA512
f753c1f455048f26e953152184d0ea64fad0ffa9173719fad979ee8662ae5356d6418e0b81623d63a29e1acb3dca2ef9941a07793daff9f2dfa2a09f89231320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33382.exe

Filesize
468KB

MD5
f588273f9a6777be5936afcbbd04fba4

SHA1
4e9c9bb44a53432331b99153b7cd0670f948decb

SHA256
fb59a0d5462787c58c7444eac8dc5e19efb489ae0e1902202871e65fd9aa0f40

SHA512
d9937b98efb279e3df096299d944c3c86e9cdbadd87598f555b75406c9db301b603da144b1bf763670742ba0d53b7b1ac933f351cf449bc9b5f745797bc8cea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34971.exe

Filesize
468KB

MD5
f35c2023a2359e9c75a1d34bcf216022

SHA1
64fee0ddec67a65bb1c3980a0787327eb47da797

SHA256
0f7f8e7f5a74aec9d831d0fd6133622d08a24333c9a3f2fd22348842e6b55b41

SHA512
6d640c80bbcdc72c767fdc986cc56113e52a9b1f54a9a85fa5ee8a803a402d3c9810d417e66a0cb3b4514344a13fb78f5b462d813db1dfa8fb9e9e82f2e06ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35547.exe

Filesize
468KB

MD5
44b33743fc478f278415a73eedeb7ffb

SHA1
a6cc7ab0995ed85632df4e759da0c81d90503bd0

SHA256
e9ee6370012e02ee4abe43a6350c9b40d88c1a81febea022210b92a1fbe3084a

SHA512
8bd629cc960a6c7343ba22ca22d945f6b297b008e3f3519a2325bcebcefe422fe623b17a36f4996e1ef9542811458f704caf95172777e4521ee4a485801a6c01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36109.exe

Filesize
468KB

MD5
c09ac91fd72cb6d4e900460e9f175132

SHA1
8ce407068d625db60b394121ab1e3470622d5e65

SHA256
e01c82fb9540da5973ca1c6fb4ed545331e324693977ef8d26fbc37ab13d5091

SHA512
61016e6985aacdb7a6ba9a1f22197e9c1db8e97f6e5dc75665df26946fedc082293c6ed83d441774afde3dd554f551f146b0c1674faeef9a99d7d2ec09fc75b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39055.exe

Filesize
468KB

MD5
b05ed972968dc726cf69b804fea0a04e

SHA1
59d758205d8fb02247ea94a5ae69287f0533a610

SHA256
9a3d42ec2f93a5a5ded4d2e7ed3fc5ca57d6cc8441d74d8a71dea6ab86b1dbdc

SHA512
05afa0727eb0e64b5447a8876f874faf25ccfd2ba36c28d28a9587dd4e361c26f8ae6ada155394ddef4cd0ee094a2b083c0d07ae982e8ed3e3b3520e9a201698

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39513.exe

Filesize
468KB

MD5
61a5e52f1e7cd53c6b1978db6a1017fe

SHA1
c3babe0cd6daa71cd1bc5035c07c126cf8b3e8de

SHA256
9ea9c325e8e6bf7e0ff430d3ef32e1efaf2b448a2dc84cc7b595204ad6516992

SHA512
c5290f73c758d30eb4c1c580d39b744367e895f3e6702c6d2639dfe0010fa6d1a55037dc72ffadb80ab7ed97d0602e34663075f93a16686e6ed27acda764918a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe

Filesize
468KB

MD5
90a96a5685332928aefaf7563f0a5e88

SHA1
961bb7e2d52c39f7d23a6860d2ae56ab2af20e55

SHA256
88b83dedb29832c09f1e2a3e886b5fabc2e8a84d2670ddd7c21b70b83174c5e8

SHA512
0f04c5270958adafc6d071bed5b58ab6a3e79df199828bb079575659f7ce3b157d29b09acf6899b38e64062c765c49383ade88ca642f3cd394f424c3705f4dda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44012.exe

Filesize
468KB

MD5
02e281e539ec239cb8d581817b2e3fa2

SHA1
e521c65e5ffaec346205a77cb981621803128410

SHA256
b2ba2e9e0aa9490073ce9334d4ab32f9241313752c5b6ab15c78283c976063e6

SHA512
8a24b17d5cca4f7a28faf753b7b65988acfded940b57cb6d0ec18f06d9f33666299e00d51b15073e6ae3ce8a3be68ce493918bf5e947d767ecd98a402a50ca8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44623.exe

Filesize
468KB

MD5
e4310b928c60151183fe55b1d6e352ec

SHA1
5514c58b7939a7817e1c5e05a4de83fb224c4c9b

SHA256
a23d34f76b19c8a18d28d53e944baa0e1384b2107582f07d8b7519e093a87f25

SHA512
2b4227d8234b545bbb4237adb83eae6b64d934e895bdedb90d796de2bc573bb9d9bdb4d8ba9345705df1c28ac94edbf4fd1f390d295b9283978cb83b0dd1a3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44853.exe

Filesize
468KB

MD5
20caac8b6423490f2b67982e1f2c81ec

SHA1
1c8ade0714d7f0d69dfc89de6172d80894073339

SHA256
51be4947e017953b3cd1f26a559bde14a272dc5a037cc0143a36432b2db282cc

SHA512
bd43fefed8314acc25953919799e4a6239406f5f1571a0154dbebc89206a42a3c62cb7e58d6f565551bdb193b9f1a3489155d0c482dc4ab77f92098014d4b035

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47245.exe

Filesize
468KB

MD5
3d9cd132c6aa41fdf08d5588b80fdc2b

SHA1
fc8d097dadd41213eb32d0d270b4759a5caeaddd

SHA256
b06fc187c79ea1d32357c7d5b73a60b2a6309e776bf6b9b1cd16fa5b55fe2281

SHA512
9b7e591b13b2da504efecc71c8423f94334297ca1a32e2b1039203f6ce36eeec054a9505ad200a0b1fde96bf1ff3f0c319fd3de2dc4203221af62e712f04074b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47800.exe

Filesize
468KB

MD5
e26362956c06f3d661774257aee9be29

SHA1
8e62d0fddacf8d602686cde8e459aa3b9e2428ad

SHA256
1c00e79d0942d619362867be158e25fad4cf9d5571ac1ca49470b6f2a4f12bf3

SHA512
ab4dd8dbfa475fd4545d2f2e009d12f4d5b899bd5643afcdc25102811d4a80e23384c39ddcecbfc221fffbfc91c75cd3ccf9cc190b510c1a958ec4c24017321f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe

Filesize
468KB

MD5
7a6ac9026a74f3c34d5d2770f87c4187

SHA1
23c880d8968b46c0b9d5f23a9760e79eca31297f

SHA256
f46b568ac3565a5c48386a3338e9ac9b976479a039f1d310dfb4d7c624ff12a5

SHA512
8517149c1aa27a56f8f742c052bdab3563d21e32c98b48c2f0ce3bf52a42af02ccc38295d636db89de72ee7bf6a83e04184c29005d8194ed12908e91beef91b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe

Filesize
468KB

MD5
4f58465d63b0f522b3b26a8d42e5a71d

SHA1
5e48bc667d52f8503e2998bce86f10f0fe983d2f

SHA256
9691ba7ea6b500da3597e0117013c8ea2714e6834ad217c7076958bddeb31757

SHA512
2e7ea0badcfcfa7f84927fbefde526545f3fc8942593b331a1534ef175e7d301bd850e1f6b6ad5d75bd510363d5874e4d6724b0dcf2e3691c02da3ec142c07e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe

Filesize
468KB

MD5
810d39f8eadfd8d6b095002f75b1b21b

SHA1
4e7e320a73504589fbbbe714d0bd4404495d398a

SHA256
52e9c1443a4bfa6cf6edad072f1b9531047a648b30fcc746782694d090b456fd

SHA512
70154da48616cebc247373d1608690bee9583c607bede380cbd96789f26c5fb551c5d3af2ed34273bdad050d45c0201dac8f27ccf86c198fbeb77d239956ab06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52320.exe

Filesize
468KB

MD5
5fd835f6c7ffa77ecf8eb29bf182275b

SHA1
d70a8b2349fc91305cd6b0368de8743c9624e4d0

SHA256
36d91f345f95b596d4e9b54a3ea02a5fae332a6a4eacd1df35efcc48702b11f9

SHA512
a46e2d5b45be48a04467e4a6d84b69dd1467255c841101a2eda10f13164a97a232cd415188e1a3b060370818e36d2efa4d7107e3994ca2dfd94acba4bf64baeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56003.exe

Filesize
468KB

MD5
65fed00051a937a027fa0294fc8ed827

SHA1
ebbc8e6b074e7af9f1eb0e5422ad4228a19ec477

SHA256
4534217f071d504fd2e31c9882347e4131529755abe30f68a6236c69da17fcb1

SHA512
58446b5f0c64cd4c309359406c1626123e7b64562f1a80290a2cad032a235ac6b82cc191a5fe226c8ad31bd3aa688c2233d1735beead9b6537eb40c62721f8ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57105.exe

Filesize
468KB

MD5
e920e20d9b6e0a2bb6c5712293a2b464

SHA1
719424b7876952a0a832e1cf8df6fea612c86d9b

SHA256
63ece0772564033ad1a4e29324fdfe5c38710a2e2c66b756585ebe917e6bb697

SHA512
f563e05c983183914afe72437885c710b7f37ec289eb7e0dea18526cf0f2a679b5088528223fc4f812d60f00ad8b9e901c494b04f7d1e72349bda3112ff5efc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58677.exe

Filesize
468KB

MD5
773628b1f39711b05858fd73a38eabc7

SHA1
e6512084701bfc54b467f38f0bcb53721736080f

SHA256
95ae6b2b431c353cd1f6f52a2ae79326edc4174731cc0fb954d02cee640b555e

SHA512
ee3dc2187eba09cf59c4a0b82e54c06f32227a792924db0cdd5829d97adea6c314bed823ace5224f17e88958b77ffb13ece4a3f85278eaf604324eabcb2b6b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58921.exe

Filesize
468KB

MD5
ca9b9a0a167e76d83052df9b47d1e07a

SHA1
be3723c3a8f1fa988b00a9c437eedf01fcafc82f

SHA256
1044b402237615e10b086da39c9ac023470d6ec59c1ece1a75c4cfd3a742cd56

SHA512
53457f526ee1dae17cb9c3a9445c4fa78268e512c66ae2b5f315864e9d6ab84ed6510a4ce134f409e217203f5a0a74c0747114f2c7ba687c3e1587b62f55749f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59329.exe

Filesize
468KB

MD5
ac1b9c6a2ced1960fbb7b2268aa075cf

SHA1
fb67fa825a30fbdb2d2a5781756e53a48a720b49

SHA256
dc349c8b23d9a10a32f4ba7dbdd0298d4a60430151910e6bfbb0efd53306f1d2

SHA512
92fada3e9a9d28cfec8de9b23215661f81a974a12f038a53694f3722377e849c1545aaa4cd9d7696026baf5ccd15517e837d670908aee4c6dfd8dca537d7e18f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6383.exe

Filesize
468KB

MD5
24fe77fc8d18fda822e5690a81d036ba

SHA1
1e5f60d5b7cb68151c23cef9c35c3b900c8b5d07

SHA256
f47d18eed8fd6ee99fad8106ad48120872365833ef567450bb449560128ac5bc

SHA512
d4eff0436f01b8a948b546241d10b60b05dfc4cdc989be96083782173381e56c97f19502f7117c47e17da625f764b5497d98bd7165aacef314e1fca379dbcdb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64017.exe

Filesize
468KB

MD5
0151a08eb70ea3f866b94b2aac3a49d6

SHA1
ea5b1ba1df17aedd08d1e8ada18c41e2b37555b1

SHA256
309f76e705e6187ca9eb7444998748e932f487796ac78e8b1d9bf79e5b3a0742

SHA512
04652ae4804b6b2398bb350d04860ebc836f21d664eb284f1ee61e02eb9da3fd58b65c0bf35e5ce280669ee223aa40f0ec0dd9f91ca471ec465255b3d7279cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6648.exe

Filesize
468KB

MD5
2cdaeb3b53452e7dc794d983dc42da7e

SHA1
1b2b3b99a2071617657a11fbe6a2297cbbce96ef

SHA256
03feec08cc6517b5d343cb27c4e7b47dbbbdcc680b91e2a837714f1bc6116d4a

SHA512
5890ff24ff7a06b29fcfaefb23e9db9fead24246a8bd715a854ae8ccbaaa4c237a8a23638c7fe1b4f18d21bfd61cc70d1fd4f8e8d30e25b2407a0f4b44210ab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe

Filesize
468KB

MD5
1ab4e271aabc4b2072271807c08f7b6d

SHA1
a9d58a4feff43dd2b96bc1cf06275f897a6b43f5

SHA256
c232e919e68a0e54314e74304bd56466daf5738b7266ad9fa87d38af5e322fe2

SHA512
8bcfe9cc82844514df86b6672563363e9d8885f544736199da206d6beda08279155656ba53758aeb827b0b7a21ece650fd2d04848137ed76ec123c6d4378b6a4

Download Submit
memory/15824-2951-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads