a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe
Size

468KB
MD5

16b9c0daa29c83701c2284e05a683ce0
SHA1

9f2f45dbe370609a709b3165a3c06285fb3b9851
SHA256

a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094
SHA512

7ac09c9f43ad57d2d05fd0bea97464a384d4a99b41bf468ebf379a14b12fb4a177bdf0b35ec0afb795964e17a5c6621cc0bd5fbcaaebe3c2d5a98aa90ecaa145
SSDEEP

3072:aby7og5+Pb8UwaYC7zojTf8/EChAZ4pfAdHeZVrs03WfyAIbkayz:abeohYUwK7UjTf/ETM03UPIbk

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4072	Unicorn-31942.exe
1520	Unicorn-38486.exe
1516	Unicorn-14536.exe
3216	Unicorn-37666.exe
2004	Unicorn-25414.exe
3448	Unicorn-5548.exe
1152	Unicorn-15199.exe
3608	Unicorn-6973.exe
1220	Unicorn-36308.exe
2164	Unicorn-27586.exe
2300	Unicorn-10984.exe
4936	Unicorn-52837.exe
4740	Unicorn-5119.exe
4452	Unicorn-19418.exe
996	Unicorn-10024.exe
2468	Unicorn-5385.exe
3312	Unicorn-6900.exe
3660	Unicorn-18598.exe
3104	Unicorn-52924.exe
3148	Unicorn-30658.exe
3592	Unicorn-6153.exe
1936	Unicorn-47741.exe
456	Unicorn-64290.exe
4796	Unicorn-47954.exe
4296	Unicorn-43870.exe
5004	Unicorn-35437.exe
2848	Unicorn-62436.exe
1040	Unicorn-59636.exe
808	Unicorn-48701.exe
4784	Unicorn-57814.exe
3252	Unicorn-16974.exe
4068	Unicorn-38140.exe
3208	Unicorn-2675.exe
3352	Unicorn-53346.exe
2332	Unicorn-26795.exe
2628	Unicorn-8976.exe
4412	Unicorn-45178.exe
3060	Unicorn-37970.exe
3408	Unicorn-58317.exe
2264	Unicorn-58774.exe
3196	Unicorn-42416.exe
5036	Unicorn-50606.exe
2764	Unicorn-28139.exe
1296	Unicorn-5681.exe
752	Unicorn-58966.exe
1104	Unicorn-22764.exe
4308	Unicorn-14596.exe
380	Unicorn-18126.exe
4440	Unicorn-9957.exe
1892	Unicorn-5873.exe
1668	Unicorn-63242.exe
4880	Unicorn-63242.exe
4900	Unicorn-49712.exe
3296	Unicorn-23724.exe
4376	Unicorn-34659.exe
4384	Unicorn-18124.exe
232	Unicorn-35157.exe
4252	Unicorn-18126.exe
1524	Unicorn-23724.exe
1404	Unicorn-43206.exe
3956	Unicorn-35784.exe
5084	Unicorn-22978.exe
2608	Unicorn-3517.exe
3024	Unicorn-36117.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9872	1344	WerFault.exe	207
16052	14852	WerFault.exe	703

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25836.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32136.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59942.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4052.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-144.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40652.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39086.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38370.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1912	dwm.exe
Token: SeChangeNotifyPrivilege	1912	dwm.exe
Token: 33	1912	dwm.exe
Token: SeIncBasePriorityPrivilege	1912	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe
4072	Unicorn-31942.exe
1520	Unicorn-38486.exe
1516	Unicorn-14536.exe
3216	Unicorn-37666.exe
2004	Unicorn-25414.exe
3448	Unicorn-5548.exe
1152	Unicorn-15199.exe
3608	Unicorn-6973.exe
1220	Unicorn-36308.exe
4740	Unicorn-5119.exe
4452	Unicorn-19418.exe
2164	Unicorn-27586.exe
2300	Unicorn-10984.exe
4936	Unicorn-52837.exe
996	Unicorn-10024.exe
2468	Unicorn-5385.exe
3660	Unicorn-18598.exe
3312	Unicorn-6900.exe
3104	Unicorn-52924.exe
3148	Unicorn-30658.exe
1936	Unicorn-47741.exe
4296	Unicorn-43870.exe
456	Unicorn-64290.exe
3592	Unicorn-6153.exe
808	Unicorn-48701.exe
5004	Unicorn-35437.exe
1040	Unicorn-59636.exe
2848	Unicorn-62436.exe
4796	Unicorn-47954.exe
4784	Unicorn-57814.exe
3252	Unicorn-16974.exe
4068	Unicorn-38140.exe
3208	Unicorn-2675.exe
3352	Unicorn-53346.exe
2628	Unicorn-8976.exe
4412	Unicorn-45178.exe
2332	Unicorn-26795.exe
3060	Unicorn-37970.exe
3408	Unicorn-58317.exe
2264	Unicorn-58774.exe
3196	Unicorn-42416.exe
2764	Unicorn-28139.exe
5036	Unicorn-50606.exe
1296	Unicorn-5681.exe
752	Unicorn-58966.exe
1104	Unicorn-22764.exe
4308	Unicorn-14596.exe
1892	Unicorn-5873.exe
4880	Unicorn-63242.exe
380	Unicorn-18126.exe
1668	Unicorn-63242.exe
4376	Unicorn-34659.exe
4900	Unicorn-49712.exe
4440	Unicorn-9957.exe
232	Unicorn-35157.exe
1524	Unicorn-23724.exe
4252	Unicorn-18126.exe
4384	Unicorn-18124.exe
1404	Unicorn-43206.exe
5084	Unicorn-22978.exe
3956	Unicorn-35784.exe
2608	Unicorn-3517.exe
3024	Unicorn-36117.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4072	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	82
PID 4136 wrote to memory of 4072	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	82
PID 4136 wrote to memory of 4072	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	82
PID 4072 wrote to memory of 1520	4072	Unicorn-31942.exe	83
PID 4072 wrote to memory of 1520	4072	Unicorn-31942.exe	83
PID 4072 wrote to memory of 1520	4072	Unicorn-31942.exe	83
PID 4136 wrote to memory of 1516	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	84
PID 4136 wrote to memory of 1516	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	84
PID 4136 wrote to memory of 1516	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	84
PID 1520 wrote to memory of 3216	1520	Unicorn-38486.exe	89
PID 1520 wrote to memory of 3216	1520	Unicorn-38486.exe	89
PID 1520 wrote to memory of 3216	1520	Unicorn-38486.exe	89
PID 1516 wrote to memory of 2004	1516	Unicorn-14536.exe	90
PID 1516 wrote to memory of 2004	1516	Unicorn-14536.exe	90
PID 1516 wrote to memory of 2004	1516	Unicorn-14536.exe	90
PID 4072 wrote to memory of 3448	4072	Unicorn-31942.exe	91
PID 4072 wrote to memory of 3448	4072	Unicorn-31942.exe	91
PID 4072 wrote to memory of 3448	4072	Unicorn-31942.exe	91
PID 4136 wrote to memory of 1152	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	92
PID 4136 wrote to memory of 1152	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	92
PID 4136 wrote to memory of 1152	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	92
PID 3216 wrote to memory of 3608	3216	Unicorn-37666.exe	94
PID 3216 wrote to memory of 3608	3216	Unicorn-37666.exe	94
PID 3216 wrote to memory of 3608	3216	Unicorn-37666.exe	94
PID 1520 wrote to memory of 1220	1520	Unicorn-38486.exe	95
PID 1520 wrote to memory of 1220	1520	Unicorn-38486.exe	95
PID 1520 wrote to memory of 1220	1520	Unicorn-38486.exe	95
PID 4136 wrote to memory of 2300	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	99
PID 4136 wrote to memory of 2300	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	99
PID 4136 wrote to memory of 2300	4136	a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe	99
PID 2004 wrote to memory of 2164	2004	Unicorn-25414.exe	96
PID 2004 wrote to memory of 2164	2004	Unicorn-25414.exe	96
PID 2004 wrote to memory of 2164	2004	Unicorn-25414.exe	96
PID 1516 wrote to memory of 4936	1516	Unicorn-14536.exe	100
PID 1516 wrote to memory of 4936	1516	Unicorn-14536.exe	100
PID 1516 wrote to memory of 4936	1516	Unicorn-14536.exe	100
PID 4072 wrote to memory of 4740	4072	Unicorn-31942.exe	98
PID 4072 wrote to memory of 4740	4072	Unicorn-31942.exe	98
PID 4072 wrote to memory of 4740	4072	Unicorn-31942.exe	98
PID 1152 wrote to memory of 4452	1152	Unicorn-15199.exe	97
PID 1152 wrote to memory of 4452	1152	Unicorn-15199.exe	97
PID 1152 wrote to memory of 4452	1152	Unicorn-15199.exe	97
PID 3448 wrote to memory of 996	3448	Unicorn-5548.exe	103
PID 3448 wrote to memory of 996	3448	Unicorn-5548.exe	103
PID 3448 wrote to memory of 996	3448	Unicorn-5548.exe	103
PID 3608 wrote to memory of 2468	3608	Unicorn-6973.exe	104
PID 3608 wrote to memory of 2468	3608	Unicorn-6973.exe	104
PID 3608 wrote to memory of 2468	3608	Unicorn-6973.exe	104
PID 3216 wrote to memory of 3312	3216	Unicorn-37666.exe	105
PID 3216 wrote to memory of 3312	3216	Unicorn-37666.exe	105
PID 3216 wrote to memory of 3312	3216	Unicorn-37666.exe	105
PID 1220 wrote to memory of 3660	1220	Unicorn-36308.exe	106
PID 1220 wrote to memory of 3660	1220	Unicorn-36308.exe	106
PID 1220 wrote to memory of 3660	1220	Unicorn-36308.exe	106
PID 1520 wrote to memory of 3104	1520	Unicorn-38486.exe	107
PID 1520 wrote to memory of 3104	1520	Unicorn-38486.exe	107
PID 1520 wrote to memory of 3104	1520	Unicorn-38486.exe	107
PID 4452 wrote to memory of 3148	4452	Unicorn-19418.exe	108
PID 4452 wrote to memory of 3148	4452	Unicorn-19418.exe	108
PID 4452 wrote to memory of 3148	4452	Unicorn-19418.exe	108
PID 2164 wrote to memory of 3592	2164	Unicorn-27586.exe	110
PID 2164 wrote to memory of 3592	2164	Unicorn-27586.exe	110
PID 2164 wrote to memory of 3592	2164	Unicorn-27586.exe	110
PID 1152 wrote to memory of 1936	1152	Unicorn-15199.exe	109

C:\Users\Admin\AppData\Local\Temp\a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe
"C:\Users\Admin\AppData\Local\Temp\a874fa07ce89b972b31609d0a7343962a3d1225009693bbcb5450da26bb11094N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22978.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        10⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59942.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28364.exe
        11⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        11⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        10⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52433.exe
        10⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16464.exe
        10⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        9⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        10⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        10⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8031.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        9⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45681.exe
        9⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        9⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        10⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        9⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        9⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10189.exe
        9⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        8⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42173.exe
        8⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49189.exe
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62526.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38074.exe
        9⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        10⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        9⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        9⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4140.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1504.exe
        8⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        8⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15180.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        7⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37114.exe
        9⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28888.exe
        9⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        9⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        9⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55157.exe
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35608.exe
        8⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        8⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        9⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4185.exe
        9⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5728.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        8⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38420.exe
        6⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55422.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        9⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63969.exe
        9⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        9⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33792.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58052.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3341.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        8⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28469.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30783.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37415.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        10⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54293.exe
        10⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        9⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        9⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        9⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        8⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38889.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20984.exe
        7⤵
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65141.exe
        6⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65266.exe
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        9⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        8⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4709.exe
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62017.exe
        7⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43274.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29169.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7063.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26795.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44166.exe
        6⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49314.exe
        7⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14213.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64301.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63361.exe
        7⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        7⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5431.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18084.exe
        6⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46833.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3060.exe
        5⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7581.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59973.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63090.exe
        6⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28664.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56916.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1908.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18562.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        9⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        9⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58280.exe
        8⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        8⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64093.exe
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25226.exe
        8⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        7⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48997.exe
        6⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29278.exe
        7⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 636
        8⤵
        Program crash
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        7⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45872.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
        7⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53909.exe
        7⤵
        
        PID:724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17535.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8976.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19470.exe
        6⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32890.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43030.exe
        9⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14960.exe
        9⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31324.exe
        9⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44929.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47949.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32506.exe
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19620.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29788.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65400.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41105.exe
        7⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60274.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11509.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        8⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
        8⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34176.exe
        7⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9619.exe
        7⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60532.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        6⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37528.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42454.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13232.exe
        7⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45836.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51834.exe
        6⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-336.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        6⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7239.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
        5⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
        6⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-497.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        8⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5063.exe
        8⤵
        
        PID:16276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        8⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65401.exe
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56796.exe
        7⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25130.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18468.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        6⤵
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13008.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2049.exe
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11252.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9863.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48290.exe
        6⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60008.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44566.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        6⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58317.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11493.exe
        5⤵
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        6⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57358.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe
        8⤵
        
        PID:14852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14852 -s 468
        9⤵
        Program crash
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64381.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39796.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61694.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        6⤵
        
        PID:1400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12380.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        5⤵
        
        PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
      4⤵
      PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46958.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43658.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6496.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14081.exe
        6⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
        5⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40672.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14301.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4697.exe
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2591.exe
      4⤵
      PID:12520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54897.exe
      4⤵
      PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43206.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46553.exe
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13185.exe
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28422.exe
        9⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        9⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        9⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35520.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        8⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
        7⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        7⤵
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        6⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6989.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41022.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36148.exe
        8⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21428.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10335.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42449.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe
        7⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55577.exe
        6⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35784.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1265.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47742.exe
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28830.exe
        7⤵
        
        PID:16892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30756.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31435.exe
        6⤵
        
        PID:12932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6489.exe
        6⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64092.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41657.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
        5⤵
        
        PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2675.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3517.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30866.exe
        6⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19242.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13180.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17979.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        7⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27153.exe
        7⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37320.exe
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        5⤵
        
        PID:844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        6⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        7⤵
        
        PID:11568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58760.exe
        6⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25083.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45182.exe
        6⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        5⤵
        
        PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36117.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11073.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        7⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9805.exe
        6⤵
        
        PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59049.exe
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26938.exe
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        5⤵
        
        PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64114.exe
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18770.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        7⤵
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58665.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32065.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9412.exe
        5⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39738.exe
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37144.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62661.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31072.exe
        5⤵
        
        PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
      4⤵
      Executes dropped EXE
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11089.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        7⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39028.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39458.exe
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        5⤵
        
        PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        5⤵
        
        PID:7336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46641.exe
        5⤵
        
        PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30949.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32807.exe
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
      4⤵
      PID:3788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1172.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56605.exe
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        6⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27388.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45045.exe
        5⤵
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2928.exe
        5⤵
        
        PID:16416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42957.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
      4⤵
      PID:13864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34659.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61322.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38370.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59913.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        5⤵
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29832.exe
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31472.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7809.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40424.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47528.exe
      4⤵
      PID:10292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-668.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
    3⤵
    PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
      4⤵
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40686.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40686.exe
    3⤵
    PID:8912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
    3⤵
    PID:12500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
    3⤵
    PID:16228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63242.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18608.exe
        9⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47300.exe
        9⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60734.exe
        9⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18628.exe
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        8⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63054.exe
        8⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64580.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        7⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        6⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        7⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18259.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46325.exe
        6⤵
        
        PID:12460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        7⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37765.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54160.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24362.exe
        7⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        6⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55822.exe
        7⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41973.exe
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29714.exe
        6⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20137.exe
        7⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5721.exe
        6⤵
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9019.exe
        5⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        6⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7632.exe
        5⤵
        
        PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10070.exe
        9⤵
        
        PID:16356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35381.exe
        8⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32224.exe
        8⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        7⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35452.exe
        6⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        7⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32257.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50725.exe
        6⤵
        
        PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22328.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62718.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17700.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64922.exe
        7⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26391.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38498.exe
        6⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53648.exe
        5⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62402.exe
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        6⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15120.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25954.exe
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61462.exe
        5⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12033.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32338.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52520.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56257.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3740.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29650.exe
        6⤵
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45437.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49833.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37300.exe
        5⤵
        
        PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33943.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50076.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        5⤵
        
        PID:1456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1996.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
      4⤵
      PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56148.exe
      4⤵
      PID:16240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15852.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
        7⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46257.exe
        7⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11331.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        6⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6413.exe
        6⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23268.exe
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39132.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        6⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39728.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25423.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17573.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14596.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13029.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29662.exe
        6⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
        7⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        7⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50601.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9717.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53133.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41902.exe
        6⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42973.exe
        5⤵
        
        PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24735.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
        5⤵
        
        PID:3792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38498.exe
        5⤵
        
        PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28723.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
      4⤵
      PID:2564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        5⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        6⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35270.exe
        7⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29028.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41000.exe
        6⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28436.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8887.exe
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20955.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45585.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7108.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17462.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42676.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        6⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57356.exe
      4⤵
      PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34094.exe
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61665.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        5⤵
        
        PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37529.exe
      4⤵
      PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58376.exe
      4⤵
      PID:13904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38384.exe
      4⤵
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38208.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46178.exe
        5⤵
        
        PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15728.exe
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
      4⤵
      PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57296.exe
    3⤵
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28254.exe
      4⤵
      PID:16640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7284.exe
    3⤵
    PID:8936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38190.exe
    3⤵
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
    3⤵
    PID:6228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12453.exe
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33030.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35328.exe
        9⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10159.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61118.exe
        9⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42536.exe
        8⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13703.exe
        8⤵
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7264.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56761.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        7⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15617.exe
        7⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33620.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54218.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54950.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        7⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        7⤵
        
        PID:17204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32728.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54922.exe
        6⤵
        
        PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8541.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31872.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        6⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34824.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30363.exe
        5⤵
        
        PID:17128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        5⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49506.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9101.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59552.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12412.exe
        6⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
        6⤵
        
        PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51892.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14544.exe
        5⤵
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14685.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21872.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61309.exe
        6⤵
        
        PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50409.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8793.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55428.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        5⤵
        
        PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
      4⤵
      PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31644.exe
      4⤵
      PID:2428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6553.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35002.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13068.exe
        7⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        5⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        5⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11784.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57809.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
      4⤵
      PID:2140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47441.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18496.exe
        6⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53673.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20911.exe
        5⤵
        
        PID:13880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-144.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62210.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4052.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58953.exe
        5⤵
        
        PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48680.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33916.exe
      4⤵
      PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
    3⤵
    PID:720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45298.exe
        5⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26407.exe
        6⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28556.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
      4⤵
      PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22283.exe
    3⤵
    PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32608.exe
    3⤵
    PID:10576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22324.exe
    3⤵
    PID:3432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5681.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58318.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65505.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25320.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52241.exe
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16355.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55306.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41473.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        5⤵
        
        PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25836.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4389.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
        7⤵
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36777.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15696.exe
        6⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51944.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1140.exe
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8155.exe
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27264.exe
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2352.exe
        5⤵
        
        PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41421.exe
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19507.exe
      4⤵
      PID:13280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37358.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39714.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48593.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31767.exe
        5⤵
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13092.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55571.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47336.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23845.exe
      4⤵
      PID:14892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
    3⤵
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
        5⤵
        
        PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
      4⤵
      PID:3668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
    3⤵
    PID:8624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
    3⤵
    PID:12644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    3⤵
    PID:3436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
      4⤵
      PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15157.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32314.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36340.exe
        6⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55253.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26584.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
        5⤵
        
        PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      4⤵
      PID:3820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25364.exe
    3⤵
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55630.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34117.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39900.exe
      4⤵
      PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
      4⤵
      PID:8228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20423.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20423.exe
    3⤵
    PID:8336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46517.exe
    3⤵
    PID:12124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33229.exe
    3⤵
    PID:4372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
    3⤵
    PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51665.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23864.exe
      4⤵
      PID:3800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25608.exe
    3⤵
    PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26472.exe
      4⤵
      PID:16648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56412.exe
    3⤵
    PID:12248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
    3⤵
    PID:16784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36830.exe
  2⤵
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29522.exe
    3⤵
    PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24228.exe
    3⤵
    PID:11908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28223.exe
    3⤵
    PID:15508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42094.exe
    3⤵
    PID:1604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47167.exe
  2⤵
  PID:8656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11516.exe
  2⤵
  PID:12072
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52550.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52550.exe
  2⤵
  PID:16688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1344 -ip 1344
1⤵
PID:9640

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10024.exe

Filesize
468KB

MD5
4121b297baf957b0fb1dc283b5606907

SHA1
df28ac48745b9903a2354d29760f9bdfaf108fbf

SHA256
4f005655c172599abcabe753809628904d96a22d072c083dd739fb2da0ae6dec

SHA512
51db7fc817fef74c92930e968192aeeabf96aaf36e55eaedc0c8ae98a04cfec5887baa39673f48b93d12aa7d99f8093e3324d03cc7d1c5dc3e6d8976c9a33b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10984.exe

Filesize
468KB

MD5
a840998a34132a3988f0c40a50b23069

SHA1
fbcd72615db4c9e7aa89fa3c19dacce0344d1bba

SHA256
ae69947e9b0f89741b08e39026a14a3d665099ea6f5afd29b435994df5f513d9

SHA512
c2b92270ca4b751baec40773aa9878bb5b34757c08770679064051f2b4d616974a4ba801e3aa5b44a8f974ca5935821dbe092db84eab9b3a57e91a62d3735036

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14536.exe

Filesize
468KB

MD5
51f06fa0a0197a9cf422a65da3c1fab4

SHA1
8a80b59196d4728643370eb950f52331844570a5

SHA256
8520b59963280d339e4fab6ff3689a24c60a8964128fbfe6d082427742eb0caf

SHA512
369a7dc1cf55627b8a1642f511c7bd17fb051e0cd0b6729b90430bffae1c5a7fe01475d393a2a152d01c1141c576d26d8c04fa799970ce477f4e293a55170310

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15199.exe

Filesize
468KB

MD5
efa8ecbe441828a42d15ec0b39b1d626

SHA1
8ba1cd532ac6cf9d328bf04a853a2a19442bcac0

SHA256
12864ae327787bdfd9512b571df648a7c5bd07fd69b5e93fe306274c414c97f0

SHA512
a44e9c0f9b9b8f933496d4812938eb25c39730fcc9c543a696f507f6ca4b760c5a1076064262d0d9ee0553e544142adcc5bfd5c1ef9e9b0f9b3517c68707064b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe

Filesize
468KB

MD5
89c42c53c8b8bf0b7cae4e152422f792

SHA1
6773d9750f3ce5f6c67ed01054053b0382d07def

SHA256
8a4bc87b14c962b5f9d83000f00f32c93185cc9dbf698e70adabe60ecdd834d0

SHA512
712d198df8355315aea5fffe379eb0da72ba4d61dc3f460bfbb1216e7c45b072aac141d06d64b42cb36b588a6584f75677945ec1c8f58b50691bd4674e87f5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18598.exe

Filesize
468KB

MD5
53e7c43b586436a96f00e187c3699f22

SHA1
818f1ec4f9610fea9978bc190a4a04a46d3e3d77

SHA256
7c103a56eff0195aa38a6d1d1f3661f1244758e19a52effa5779980ded7f0aa6

SHA512
45df109a5d590a5b8120a36b1bb50f5f00cf3501ae8969eb9b4e0e502f4559a24b9019b313f74edec18eda3d20080de9df0c6071f46888fc0b611099bf7afc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19418.exe

Filesize
468KB

MD5
a4d56cb11a5181e67daa9acab24f9ce9

SHA1
aaad3b2999aec61ff987d87bdeabc4808d25d7c7

SHA256
23f8392d90cc43f9970caf8e325b486ad592ae7ffd58b5d2c8912fe9394b8fff

SHA512
d4cca8ec2e076027f1d6ffb3a1c60ab28cd88ea32f814903259e1b9fb1d229be65f5e34ba041f23ea5bc7d275413c08cec47b70217e8d5426b606681c0cb96e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25414.exe

Filesize
468KB

MD5
8c3e7a1361580a7ba9d036926d903107

SHA1
51cf8d4156d2918340749a003ce1d7956e1f0810

SHA256
82fa15dc2964fdd4d3b6d6aa940f929282f3fb4139e8d99b8e90a4940d76ea82

SHA512
21e1abc8135d12515da5682356670e733236cb96d640b2eeeacdcbf6a84bbfe605e6bbfdb707a1978bb05c005af37554d19a2cf6dc49b0bae48a5d184e2250b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27586.exe

Filesize
468KB

MD5
37ed4994b8e6b0214d49a0a5dda22339

SHA1
4ee0adf7d3641d7453bde324f010252af65475f6

SHA256
8db3fc188be64c15cc99b365e44e9072f12d508afc75fa5ce14d4429148142a0

SHA512
b7bd082befc1f88e666d99ebc361e1fe25afb65b450d8da1e1698a092cc11663630d9ade6296a8dcc61de493f816e7d276b3b2bba30825970eda853f35a12a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe

Filesize
468KB

MD5
d483a149cc2f192ad84a2c86c539b8f4

SHA1
ce6e44ed860078a56453759b73a5966488feb861

SHA256
1bc3a0e4ff8eaa5714e9900db463e8f8842c0be8060bb41b1c85ffaeae720c86

SHA512
4590e20aa1be8a225d8b9eabf9ae43df67d228f0ddffe5fee743d5bcea6fecc27ec0282ffb40c53ffcdc81d968952ab74ac4a28f69c6287ad4241f154bef9f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31942.exe

Filesize
468KB

MD5
96c7abf97ccc208237c803d0a1a522ef

SHA1
ff3e6a79ac2b5f61d6aea972237fac43563fd984

SHA256
ec68784475c6b95066cfc86d94d1b443f278a6088836e5d1cbe5d66f1323d1fb

SHA512
cae5c82eff47a2522633c4379463a63fe52369951e4b8c3398c0533fcd95d446423501254158797e0e3ef5ced88b72a29ba7291a1b93be068ff32186703bd0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe

Filesize
468KB

MD5
e1c2a95add4d70623adb124f1ea03d47

SHA1
a5ea942b1e6fef36d70cf12560cd50c3645e5e20

SHA256
3a62a31e87d754362f8518a1c977bfc2a8c3f42b8da546a2ae401ebebe81f928

SHA512
4c47040d102ab1fbd1d3ddbce75e605ee29e97f1cb5ef565a36ddaa908432387910d227c64dfd062fd0283d6705b4731eb8c145a8a37109eda939aea40e54cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36308.exe

Filesize
468KB

MD5
05c523f3152597a81f78d0e619f978de

SHA1
693b7caffde14f6d8080acf0c1dadd83fa06459e

SHA256
c500e187e576a3628646a4587af93e21e331011da001769c3a5a802ee803f582

SHA512
421fae1d9a436076900467d5ad422b0483766c39ac2fb0c95a5d544bd809d448ac78633b0ada2e0884d127b16d961879b8205de81ed2122c8dd218ead590e833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37666.exe

Filesize
468KB

MD5
ff2f304ce79cce602d9983a94c2784f1

SHA1
37a01203a7d4e67b6fa9c4001a862b978e7d0710

SHA256
00483bf7af566f2e122480b8d432214a8aa0fa19197a5aff52676c5e86804366

SHA512
eecb68faeca72aaeb291c289f717ee5dfea397f4cdac174c85ba55bec71134fd88d3d6d7610f381c6cd08b09c00825c9b5d4a8310b24b36d767187747038637e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe

Filesize
468KB

MD5
80993c653d16598aba16a87d6cca1d50

SHA1
20be484d00065aa8117a65dd8d93ae3d698df6ee

SHA256
f5ffe8989cd1d14ea5d60093fe1040f4b892ccba1934f04dffa920a4b2fb2fe4

SHA512
82405d6cd7686a84cb2081511cfd8b8fa15f3de70a2f4ff05314aad337b7f18dab01da5b9dfc2e658f020891f8f5ee3393ab73f17f69890f3d55671b5a0ba0f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe

Filesize
468KB

MD5
357779e665dbbbf85152636790e44333

SHA1
0bec2479d9792dfaf6f0913152c1971c82b47c62

SHA256
d6808b107c852a9f46010085929a5b3cb8a68bec33b6e9b16ced864704b94227

SHA512
88d2543252ede01fece48ea13588d9a4adbc3e6cfe68db94d0a18fe197c0b568ace63e3c88e0da5ce2cf84003ca89f2d19822991a3b073790cd24b46e2c47906

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43870.exe

Filesize
468KB

MD5
17d23fce24ac0c88e99f29fe1717927a

SHA1
16b701bf5b75581319628b10e260f72e9f553063

SHA256
3e68e10d1eb9e1f21ff4d0686b032135b2b7b1f45e72b643fad3e0a3a1a852b8

SHA512
b0080c35c1feac7c123e4f6d709a35727c8014f21d23fb912e67222f7d338d471b436cad54f1748c4d0d46c7ccbd63fc74e7039d346ab88cfe9d378e7b2e6e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe

Filesize
468KB

MD5
d7a31d9c93d32f8c0f571502420b0ef5

SHA1
40c7e829240017258020807870006de7d9af33e9

SHA256
6ca168bd7f26299838538e89ed1c0c5bbbad4b3bec6e7cd366fe55cc6b07d497

SHA512
4777648870c533f2025f9f02ad9fba5a8c3529b6a6334bb5bb2f4b458a2b950b6b83bdedb8f6ffd8457b30c6734922de8493f6f2398511ce9bc942025c3fab6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47741.exe

Filesize
468KB

MD5
917ebaad2f68ddcc66f46384acc54a71

SHA1
fda42bce3182b572204971f8c18ef5bb3fcd1e43

SHA256
a69502749e5463b5cd9e7e7baeb31af90927f6ed25710c675ee87ef8df116266

SHA512
50f072e6bb85b8b61884fe9e47859193e1bc46c31f90ad5db8f4d02796274e9857f5666e7ed08e2a94bdc0bbcfe9a9f8eefa14d0d785585be654d3983e4c4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe

Filesize
468KB

MD5
dc1150f5cb0ff1225433d24758f092d9

SHA1
0b43f1b6ad30e2a7566d199ba23c96926ddad523

SHA256
615f24b8345bbb4d43a21657cdb7aeea15957c88734a4cf1e422845f19974841

SHA512
0ee7617b914c8124aafe7394d361d7e9afa0b3791383a07667328a99c888c7003d0b79c49b210efc6165debbc692d45be0b1aeb94d42d2201f3a3ee3f50ff4a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe

Filesize
468KB

MD5
9af045d7f45ce097fe33ca1a72a2cecf

SHA1
a38368249f97bd900bd09093d26e215113453e1a

SHA256
0d975542e45cfea1ff9221819bfbfed6c24717c2453beec0878f0f409d881604

SHA512
3e04c7b5529d73fb7738b01a6a927a788c070cad1d3716e958cf53660f3c1ffd980c5ff24a9feac09d22f060296f26ced3d89632335f22628925e7dfa4203c0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5119.exe

Filesize
468KB

MD5
90608717ffebafa23f75280778096b8e

SHA1
fb2cc17b7289c716100c1c56627e608082f6afb3

SHA256
1e6f27f507d55ddd35bd0a4e133526d779f4698e048cb0563c0d7629fbfcbe48

SHA512
b6a732556773c25cb17d2be4f1efccfa3ff6db1f39262e2b643dff2d61bd355e3ef98bb2b84a581d08b1abea4c7630233065560e2cc5047da489692c92003ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe

Filesize
468KB

MD5
4cf259652f0ec93814de568a33d7c398

SHA1
c6afacb199e0079fddd8fb6458e9d658d74d02a8

SHA256
558ab40ffc8c93e727d79a5ed68cdf798c61d70ea15d28bb48d75d9d725ee9f8

SHA512
6ed436fa9eb8745013c8eb8ea0e5ac93dd16a669dc1ec16698e7f36531d93940529418297f0fbf193fee6b7c6452b456997ef43c40acbdde1394998549af025b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52924.exe

Filesize
468KB

MD5
a94e8948a755e02ea717e5aa4dd7068b

SHA1
6cadbc9a380e86e5623666f009850ca7ba380628

SHA256
a8e0c98de32857d6a958d655fdcfc317eb85e447e175638fb4d4c30a78ec2c4f

SHA512
f37b6cf6ce737df1f65b2f3be0a6e70cbb1ceb4f35c84a3f70ca325e64b9aa4756945152fe90ed58fe9648a5e8ae42e62a695f2c7f345600aa68a8895716afb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5385.exe

Filesize
468KB

MD5
d390ea4e1c560c7c38f4464d06456d56

SHA1
a975d8c95658dba01578cd0c710a18d21d583746

SHA256
be12ff23c95e1225bf3334b29fd7e632a46dafdc6f8356ccd984ed32236178c2

SHA512
8d4cf772a7ee22fe9143dd5fc4ddf1f81c2477d79cd93aa1881787d459cc25cebe62fe7cc421c50b6c0cbca7154c88403fb3b02b885f763134e106424a49685a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5548.exe

Filesize
468KB

MD5
1bff7284d7aa0a78f1afa610640aa76a

SHA1
3823923873f3f04f76bbb54298842afcfd393237

SHA256
2719e8e7313378302df47c82a5e6becc20e061d3a06a1362d02180007a2b1338

SHA512
2957ec577d8e5540d6356e31b85b44c24e039123851d0dca69ed36a54dacb7b909b648cf17394403d676ccaa1e454337e9db1e7c0826afc744b39f338e5d670b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57814.exe

Filesize
468KB

MD5
b6373f7acf51fe9bbdf818a38398f720

SHA1
2fe741ba405e25cf683b136a5af27b128c669d48

SHA256
98e6250fdf1469055e74b219ed8703c0ebfe3141c1d5ce988ab75adf3a258902

SHA512
8897477a26fe7100a18cbdc25ff73546563d48936aa8e8bb12d771261ebff8f814d93392e5ce232c5b98bc5a0abb3f89c57c4fe5db119ce4e949a951287cd3c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59636.exe

Filesize
468KB

MD5
e8f4dc4f322ce980a29b1973ee794d0c

SHA1
c256d8236877d482569bc4c4c38e04f9cafe4839

SHA256
aaf95905c1e1074cbeac12c84dbe2ef777fec22aa2ab3bbbdadfdeb840ba3ef8

SHA512
a2f1d10fc0dff71b55f1b2a540cc7494f331a3481e0e8e4311ce6ccc274604afd24bb72a3a7f8c8054f243e6f080bb1561d8ff5c20f2206338859c01767ea7d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6153.exe

Filesize
468KB

MD5
86ff5281cacdd6410a57e027bcd08ce4

SHA1
7127f06f766d7395f1ee3030ebb9b66628538713

SHA256
bf5b906f21f8517530d5201ddfd7dd0b591de5d541bad9caed8a6dcc0b6473df

SHA512
f1cf33d9c2e6191b02674dd3a7041165f5a1ecd3be0e05c6e0bf1404e3226a8ba5a10cfac491d9a3841c59f5092cc2a58436ee017408428d82d4a51e407aa53a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe

Filesize
468KB

MD5
3f7c4fe2c5050aceb5f000b902e6ee43

SHA1
866fd7eb41215ee2f18d0f58fccad27bf1d61d77

SHA256
76ebfc0f58a58b7008bb29de5f97169508bf35c62a061f699e3d6c4a3bbf1ec0

SHA512
f047aa3b02c8c07378c27ca5259786cf53ef0be96adb436e0407563ae3784b7f5650a90af96dae7a8949977f0fc639d71f6530de1e57deb178b64d42385f0fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64290.exe

Filesize
468KB

MD5
deba81f3db7ead05386c4e924b57e244

SHA1
e352977ad2baf29e55f13ce2108f1c10072d62d7

SHA256
eb2c871ab8e7d10ff54ba202102bf78350da2fd47e5169b31b9c599ab4167efb

SHA512
9004df1a57f1f020885923555769cb4c73675b192394793f762049855dfa00199ff68c12da42d46c77b3db7802e6aab1e71bb137fafa17128c132bd6ac2ff5ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe

Filesize
468KB

MD5
3d9d45ee525c1d7b4dbfae0d1a43f481

SHA1
def5ea236cca2c4f2df7d68cb85d5735b02f9c85

SHA256
25861e0a05d3e403be6b17c28b694cb74363f558109cef61ae2b49c292828da3

SHA512
572c6c74bb2791f6209cc98857c2570caec881a80f1b91428d04f70b63f9192a91023b7afec515bd324b77456d841c7347db93c48d01f3b5aca23f83e3690478

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe

Filesize
468KB

MD5
f23c25065deb2e9c7f0cd25175ff9150

SHA1
9cbb28974459a8fe44dbd1b5ca4df843933eceaf

SHA256
ee60e3d5400093fe50f83c42fda8a006c04e5e6c46ccf63172ec78da33fda32d

SHA512
d5b70bdacfe118690c6bcfac59d64cc1e65eff6e7f0423734a07e49eacb262232fa8ed23c500b6d102b4ce1cf48114392485f11933d39e65539f70ffc3185df4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe

Filesize
468KB

MD5
320b8ac5096ddf0ecdeba39fcf63f94b

SHA1
bc72e36c03179cbad9fd483bbc9ffe4396ca2a67

SHA256
d37bc19e13fe13215420b7638919bd2e285c139e66fd273af6c8c39c080b5515

SHA512
e8b8d16e066dffa414e1b3038d09a94f980abc016383a76458c2b067dfc9dabf5ebefef3082c5908d2aaa16e5cca702fd3ccbd7bc373be45e1f71f6dd0255306

Download Submit
memory/232-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/996-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1104-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1220-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1296-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1516-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1520-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1668-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1892-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2040-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3024-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3060-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3104-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3312-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3352-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3384-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5004-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-733-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-745-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-746-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-747-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-766-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-748-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-767-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads